Security fixes n.a.v. pentest op noorlander.info

- CSRF token toegevoegd aan admin login formulier
- Directory listing uitgeschakeld (Options -Indexes)
- Secure/SameSite=Strict cookie verbeterd in AdminAuth
- app.js.backup en source maps verwijderd
- Version disclosure configureerbaar via config.json
- .map en backup extensies geblokkeerd in .htaccess

public/admin.php

@@ -133,17 +133,24 @@ function handleLogin(AdminAuth $auth): void
     $error = '';
 
     if ($_SERVER['REQUEST_METHOD'] === 'POST') {
-        $username = trim($_POST['username'] ?? '');
-        $password = $_POST['password'] ?? '';
+        $csrfToken = $_POST['csrf_token'] ?? '';
+        if (!$auth->verifyCsrf($csrfToken)) {
+            $error = 'Ongeldige CSRF token. Probeer opnieuw.';
+        } else {
+            $username = trim($_POST['username'] ?? '');
+            $password = $_POST['password'] ?? '';
 
-        $result = $auth->login($username, $password);
-        if ($result['success']) {
-            header('Location: admin.php?route=dashboard');
-            exit;
+            $result = $auth->login($username, $password);
+            if ($result['success']) {
+                $auth->regenerateCsrfToken();
+                header('Location: admin.php?route=dashboard');
+                exit;
+            }
+            $error = $result['message'];
         }
-        $error = $result['message'];
     }
 
+    $csrfToken = $auth->getCsrfToken();
     require __DIR__ . '/../admin/templates/login.php';
 }