Team-Eingang: /api/team mit Appwrite-JWT fuer alle Mitarbeiter, CORS-Header fuer Uploads

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

server/middleware/cors.js

@@ -0,0 +1,17 @@
+// CORS fuer das Ticketsystem (Bearer-JWT, keine Cookies). Die X-*-Header braucht der Chat-Upload.
+const ALLOW_HEADERS = 'Authorization, Content-Type, X-File-Name, X-Attachment-Kind, X-Duration-Ms, X-Image-Width, X-Image-Height'
+
+export function corsMiddleware(allowedOrigins) {
+  return (req, res, next) => {
+    const origin = req.get('Origin')
+    if (origin && allowedOrigins.includes(origin)) {
+      res.setHeader('Access-Control-Allow-Origin', origin)
+      res.setHeader('Access-Control-Allow-Headers', ALLOW_HEADERS)
+      res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PATCH, DELETE, OPTIONS')
+      if (req.method === 'OPTIONS') {
+        return res.sendStatus(204)
+      }
+    }
+    return next()
+  }
+}