Runner: Eingabepruefung gehaertet (R8)

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

runner/src/server.js

@@ -1,7 +1,7 @@
 import http from 'node:http';
 import crypto from 'node:crypto';
 import { readFileSync } from 'node:fs';
-import { validateJob, isValidSub } from './validate.js';
+import { validateJob, isValidSub, isValidRunId } from './validate.js';
 
 const MAX_BODY = 256 * 1024;
 
@@ -63,6 +63,7 @@ export function createApiServer({ config, jobs, dev, mem = readMemAvailable }) {
         return send(res, 200, jobs.submit(v.job));
       }
       if (method === 'GET' && parts[0] === 'jobs' && parts.length === 2) {
+        if (!isValidRunId(parts[1])) return send(res, 400, { error: 'Ungültige Lauf-ID' });
         const run = jobs.get(parts[1]);
         return run ? send(res, 200, run) : send(res, 404, { error: 'Lauf nicht gefunden' });
       }
@@ -81,6 +82,7 @@ export function createApiServer({ config, jobs, dev, mem = readMemAvailable }) {
       return send(res, 404, { error: 'Nicht gefunden' });
     } catch (e) {
       const status = e.status || 500;
+      if (status >= 500) console.error('Runner-Fehler:', e);
       if (!res.headersSent) send(res, status, { error: status === 500 ? 'Interner Fehler' : e.message });
     }
   });