chore: aktuellen Live-Stand sichern (Admin-API, Services, Auth-Erweiterungen)

Sichert den bisher uncommitteten Produktionsstand des Kundenbereich-Servers,
damit kuenftige Deploys (git reset --hard) nichts mehr verwerfen.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/services/previewSession.js

@@ -0,0 +1,44 @@
+import { SignJWT, jwtVerify } from 'jose'
+import { config } from '../config.js'
+
+export const PREVIEW_COOKIE_NAME = 'preview_session'
+
+const secret = new TextEncoder().encode(config.preview.sessionSecret)
+
+export async function createPreviewSessionToken(payload) {
+  return new SignJWT(payload)
+    .setProtectedHeader({ alg: 'HS256' })
+    .setIssuedAt()
+    .setExpirationTime(`${config.preview.sessionMaxAge}s`)
+    .sign(secret)
+}
+
+export async function verifyPreviewSessionToken(token) {
+  try {
+    const { payload } = await jwtVerify(token, secret)
+    return payload
+  } catch {
+    return null
+  }
+}
+
+export function previewSessionCookieOptions() {
+  return {
+    domain: config.preview.cookieDomain,
+    path: '/',
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'lax',
+    maxAge: config.preview.sessionMaxAge * 1000,
+  }
+}
+
+export function clearPreviewSession(res) {
+  res.clearCookie(PREVIEW_COOKIE_NAME, {
+    domain: config.preview.cookieDomain,
+    path: '/',
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'lax',
+  })
+}