Fix security and correctness issues found in full-codebase audit

- Restrict meetingPassword field so it isn't leaked via the public REST/GraphQL API
- Fix booking slot computation to use Europe/Berlin time instead of the server's UTC clock
- Reset email verification when a customer changes their email address
- Fix ICS calendar injection via unescaped carriage returns in event descriptions
- Bind WebRTC meeting kicks to a persistent client id so they survive a rejoin
- Move the meeting signaling token out of the WebSocket query string into the first message
- Prevent duplicate signaling connections from leaking when the same participant reconnects
- Use the rightmost X-Forwarded-For entry for rate limiting (single trusted reverse proxy)
- Use constant-time comparison for the cron endpoint's bearer token
- Remove SVG from allowed Media upload types (stored-XSS risk, unused anyway)
- Add baseline security headers and a CSP to next.config.ts
- Fix CI/CD script injection via unsanitized git ref names in release.yml

collections/Events.ts

@@ -1,5 +1,5 @@
 import type { CollectionBeforeChangeHook, CollectionConfig } from "payload";
-import { isAdmin, publishedOrAdmin } from "@/access";
+import { isAdmin, isAdminFieldLevel, publishedOrAdmin } from "@/access";
 import { slugField } from "@/fields/slug";
 import { seoFields } from "@/fields/seo";
 import { generateMeetingPassword } from "@/lib/meeting/password";
@@ -162,6 +162,13 @@ export const Events: CollectionConfig = {
           name: "meetingPassword",
           type: "text",
           label: "Meeting-Passwort",
+          // Events are publicly readable (publishedOrAdmin) via the REST/
+          // GraphQL API, so without this the plaintext password would be
+          // returned to any visitor fetching the event — defeating the
+          // password check in app/(payload)/api/meetings/[slug]/join. Only
+          // exposed to admins there; the join route reads it via the Local
+          // API, which bypasses field access by default.
+          access: { read: isAdminFieldLevel },
           admin: {
             readOnly: true,
             condition: (data) => Boolean(data?.isOnline),