Security fixes n.a.v. pentest op noorlander.info

- CSRF token toegevoegd aan admin login formulier
- Directory listing uitgeschakeld (Options -Indexes)
- Secure/SameSite=Strict cookie verbeterd in AdminAuth
- app.js.backup en source maps verwijderd
- Version disclosure configureerbaar via config.json
- .map en backup extensies geblokkeerd in .htaccess

public/.htaccess

@@ -1,23 +1,22 @@
+# Disable directory listing
+Options -Indexes
+
 # Security - Block access to sensitive files and directories
 <Files ~ "^\.">
     Order allow,deny
     Deny from all
 </Files>
 
-<FilesMatch "\.(php|ini|log|conf|config)$">
+<FilesMatch "\.(php|ini|log|conf|config|map)$">
     Order allow,deny
     Deny from all
 </FilesMatch>
 
-# Block access to core directories
-<IfModule mod_authz_core.c>
-    <RequireAll>
-        Require all granted
-        <RequireNone>
-            Require all denied
-        </RequireNone>
-    </RequireAll>
-</IfModule>
+# Block access to backup files
+<FilesMatch "\.(backup|bak|old|orig|swp|save)$">
+    Order allow,deny
+    Deny from all
+</FilesMatch>
 
 # Directory protection
 <Directory ~ "^\.|/(config|templates|vendor|cache)/">