security: harden application security baseline

- Fixed SQL injection vulnerabilities with prepared statements
- Added column whitelist protection for dynamic termin updates
- Extracted iCloud credentials into protected config file
- Moved sensitive configuration files out of webroot
- Added authentication and admin checks to PVE APIs
- Added CSRF protection to write operations and APIs
- Disabled debug output in production mode
- Added centralized configuration handling
- Protected sensitive directories with access rules
- Added initial project security documentation

api/invoice_create_from_termin.php

@@ -1,6 +1,7 @@
 <?php
 header('Content-Type: application/json; charset=utf-8');
 require_once "../config/config.php";
+require_once "../config/session.php";
 require_once __DIR__ . '/../lib/InvoiceNo.php';
 
 global $pdo;
@@ -10,6 +11,12 @@ try {
     throw new RuntimeException('Method not allowed');
   }
 
+  // CSRF check
+  $csrf = $_POST['csrf_token'] ?? '';
+  if (empty($_SESSION['csrf_token']) || !hash_equals($_SESSION['csrf_token'], $csrf)) {
+    throw new RuntimeException('CSRF validation failed');
+  }
+
   $terminId = (int)($_POST['termin_id'] ?? 0);
   if ($terminId <= 0) {
     throw new RuntimeException('termin_id fehlt');
@@ -103,4 +110,5 @@ try {
     'ok' => false,
     'error' => $e->getMessage()
   ], JSON_UNESCAPED_UNICODE);
-}
+}
+</create_file>