Fix security and correctness issues found in full-codebase audit

- Restrict meetingPassword field so it isn't leaked via the public REST/GraphQL API
- Fix booking slot computation to use Europe/Berlin time instead of the server's UTC clock
- Reset email verification when a customer changes their email address
- Fix ICS calendar injection via unescaped carriage returns in event descriptions
- Bind WebRTC meeting kicks to a persistent client id so they survive a rejoin
- Move the meeting signaling token out of the WebSocket query string into the first message
- Prevent duplicate signaling connections from leaking when the same participant reconnects
- Use the rightmost X-Forwarded-For entry for rate limiting (single trusted reverse proxy)
- Use constant-time comparison for the cron endpoint's bearer token
- Remove SVG from allowed Media upload types (stored-XSS risk, unused anyway)
- Add baseline security headers and a CSP to next.config.ts
- Fix CI/CD script injection via unsanitized git ref names in release.yml

components/meeting/JoinForm.tsx

@@ -2,11 +2,29 @@
 
 import { useState, type FormEvent } from "react";
 import { useRouter } from "next/navigation";
-
-const fieldClass =
-  "w-full rounded-2xl border border-anouma-taupe/30 bg-white px-5 py-3.5 text-base text-anouma-plum placeholder:text-anouma-plum/50 focus:border-anouma-mauve-dark focus:outline-none";
+import { TextField, FormError } from "@/components/FormField";
 
 export const MEETING_SESSION_KEY = "anouma-meeting-session";
+const MEETING_CLIENT_ID_KEY = "anouma-meeting-client-id";
+
+// A stable per-browser identity so a host's "kick" survives the removed
+// participant simply reconnecting (which always gets a fresh participantId
+// — see lib/meeting/token.ts). Deliberately in localStorage, not
+// sessionStorage: it must outlive the "kicked" screen clearing the session
+// and the "Erneut beitreten" link going back through this form again.
+function getOrCreateClientId(): string {
+  try {
+    const existing = localStorage.getItem(MEETING_CLIENT_ID_KEY);
+    if (existing) return existing;
+    const created = crypto.randomUUID();
+    localStorage.setItem(MEETING_CLIENT_ID_KEY, created);
+    return created;
+  } catch {
+    // Storage unavailable (private browsing, etc.) — fall back to a
+    // one-off id; kicks just won't stick across reconnects in that case.
+    return crypto.randomUUID();
+  }
+}
 
 export type StoredMeetingSession = {
   token: string;
@@ -33,7 +51,7 @@ export function JoinForm({ slug }: { slug: string }) {
       const res = await fetch(`/api/meetings/${slug}/join`, {
         method: "POST",
         headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({ name, password }),
+        body: JSON.stringify({ name, password, clientId: getOrCreateClientId() }),
         credentials: "include",
       });
       const data = await res.json();
@@ -62,41 +80,27 @@ export function JoinForm({ slug }: { slug: string }) {
 
   return (
     <form onSubmit={handleSubmit} className="space-y-5">
-      <div>
-        <label htmlFor="name" className="mb-2 block text-sm font-medium text-anouma-plum">
-          Dein Name
-        </label>
-        <input
-          id="name"
-          type="text"
-          required
-          value={name}
-          onChange={(e) => setName(e.target.value)}
-          placeholder="Name eingeben"
-          className={fieldClass}
-          autoComplete="name"
-        />
-      </div>
-      <div>
-        <label htmlFor="password" className="mb-2 block text-sm font-medium text-anouma-plum">
-          Meeting-Passwort
-        </label>
-        <input
-          id="password"
-          type="text"
-          required
-          value={password}
-          onChange={(e) => setPassword(e.target.value)}
-          placeholder="Passwort eingeben"
-          className={fieldClass}
-          autoComplete="off"
-        />
-      </div>
-      {error && (
-        <p role="alert" className="text-sm text-red-700">
-          {error}
-        </p>
-      )}
+      <TextField
+        label="Dein Name"
+        id="name"
+        type="text"
+        required
+        value={name}
+        onChange={(e) => setName(e.target.value)}
+        placeholder="Name eingeben"
+        autoComplete="name"
+      />
+      <TextField
+        label="Meeting-Passwort"
+        id="password"
+        type="text"
+        required
+        value={password}
+        onChange={(e) => setPassword(e.target.value)}
+        placeholder="Passwort eingeben"
+        autoComplete="off"
+      />
+      {error && <FormError>{error}</FormError>}
       <button
         type="submit"
         disabled={loading}