chore: aktuellen Live-Stand sichern (Admin-API, Services, Auth-Erweiterungen)

Sichert den bisher uncommitteten Produktionsstand des Kundenbereich-Servers,
damit kuenftige Deploys (git reset --hard) nichts mehr verwerfen.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/index.js

@@ -8,6 +8,12 @@ import authRoutes from './routes/auth.js'
 import projectsRoutes from './routes/projects.js'
 import featuresRoutes from './routes/features.js'
 import giteaWebhookRoutes from './routes/webhook/gitea.js'
+import adminGiteaRoutes from './routes/admin/gitea.js'
+import adminWebsiteProjectsRoutes from './routes/admin/websiteProjects.js'
+import adminCustomersRoutes from './routes/admin/customers.js'
+import adminEmployeesRoutes from './routes/admin/employees.js'
+import adminInvoiceClientsRoutes from './routes/admin/invoiceClients.js'
+import adminPreviewOpenRoutes from './routes/admin/previewOpen.js'
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url))
 const publicDir = path.join(__dirname, '..', 'public')
@@ -19,9 +25,28 @@ app.set('trust proxy', 1)
 app.use(sessionMiddleware())
 app.use(express.json({ limit: '2mb' }))
 
+app.use((req, res, next) => {
+  const origin = req.get('Origin')
+  if (origin && config.cors.allowedOrigins.includes(origin)) {
+    res.setHeader('Access-Control-Allow-Origin', origin)
+    res.setHeader('Access-Control-Allow-Headers', 'Authorization, Content-Type')
+    res.setHeader('Access-Control-Allow-Methods', 'GET, POST, PATCH, DELETE, OPTIONS')
+    if (req.method === 'OPTIONS') {
+      return res.sendStatus(204)
+    }
+  }
+  return next()
+})
+
 app.use('/api/auth', authRoutes)
 app.use('/api/projects', projectsRoutes)
 app.use('/api/features', featuresRoutes)
+app.use('/api/admin/gitea', adminGiteaRoutes)
+app.use('/api/admin/website-projects', adminWebsiteProjectsRoutes)
+app.use('/api/admin/customers', adminCustomersRoutes)
+app.use('/api/admin/employees', adminEmployeesRoutes)
+app.use('/api/admin/invoice-clients', adminInvoiceClientsRoutes)
+app.use('/api/admin/preview-open', adminPreviewOpenRoutes)
 app.use('/webhook', giteaWebhookRoutes)
 
 app.get('/api/health', async (_req, res) => {