feat: redesign CMS and unify German admin UI

lib/auth/rateLimit.ts

@@ -1,6 +1,6 @@
 /**
  * Minimal in-memory fixed-window rate limiter for a single Node process
- * (this app always runs as one process — see server.ts). Good enough to
+ * (this app always runs as one process - see server.ts). Good enough to
  * blunt abuse of the email-verification resend endpoint without adding an
  * external store; resets on deploy/restart, which is an acceptable
  * trade-off for this use case.
@@ -34,12 +34,12 @@ export function checkRateLimit(key: string, opts: { max: number; windowMs: numbe
 
 export function getClientIp(request: { headers: Headers }): string {
   // Deployment is always behind exactly one trusted reverse proxy (see
-  // DEPLOYMENT.md — Nginx Proxy Manager; the app port isn't published
+  // DEPLOYMENT.md - Nginx Proxy Manager; the app port isn't published
   // directly to the host). nginx's default `$proxy_add_x_forwarded_for`
   // *appends* the real client IP to any X-Forwarded-For it already
   // received rather than replacing it, so a directly-connecting client
   // could prepend arbitrary spoofed entries of their own. Only the
-  // right-most (last) entry — the one the trusted proxy itself appended —
+  // right-most (last) entry - the one the trusted proxy itself appended -
   // is trustworthy; taking the first entry would let a client bypass this
   // rate limit entirely by sending a fake X-Forwarded-For header.
   const forwarded = request.headers.get("x-forwarded-for");