chore: aktuellen Live-Stand sichern (Admin-API, Services, Auth-Erweiterungen)

Sichert den bisher uncommitteten Produktionsstand des Kundenbereich-Servers,
damit kuenftige Deploys (git reset --hard) nichts mehr verwerfen.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

server/services/staffPreviewTokens.js

@@ -0,0 +1,30 @@
+import { randomBytes } from 'node:crypto'
+
+const TOKEN_TTL_MS = 60 * 1000
+const tokens = new Map()
+
+function purgeExpired() {
+  const now = Date.now()
+  for (const [key, entry] of tokens) {
+    if (entry.expiresAt <= now) tokens.delete(key)
+  }
+}
+
+export function createStaffPreviewToken(payload) {
+  purgeExpired()
+  const token = randomBytes(32).toString('hex')
+  tokens.set(token, {
+    ...payload,
+    expiresAt: Date.now() + TOKEN_TTL_MS,
+  })
+  return token
+}
+
+export function consumeStaffPreviewToken(token) {
+  purgeExpired()
+  const entry = tokens.get(token)
+  if (!entry) return null
+  tokens.delete(token)
+  if (entry.expiresAt <= Date.now()) return null
+  return entry
+}