Fix security and correctness issues found in full-codebase audit

- Restrict meetingPassword field so it isn't leaked via the public REST/GraphQL API
- Fix booking slot computation to use Europe/Berlin time instead of the server's UTC clock
- Reset email verification when a customer changes their email address
- Fix ICS calendar injection via unescaped carriage returns in event descriptions
- Bind WebRTC meeting kicks to a persistent client id so they survive a rejoin
- Move the meeting signaling token out of the WebSocket query string into the first message
- Prevent duplicate signaling connections from leaking when the same participant reconnects
- Use the rightmost X-Forwarded-For entry for rate limiting (single trusted reverse proxy)
- Use constant-time comparison for the cron endpoint's bearer token
- Remove SVG from allowed Media upload types (stored-XSS risk, unused anyway)
- Add baseline security headers and a CSP to next.config.ts
- Fix CI/CD script injection via unsanitized git ref names in release.yml

lib/booking/slots.ts

@@ -3,6 +3,8 @@ import { WEEKDAYS } from "@/collections/Availability";
 
 export type TimeSlot = { start: Date; end: Date };
 
+const BERLIN_TZ = "Europe/Berlin";
+
 const WEEKDAY_BY_INDEX = [
   "sunday",
   "monday",
@@ -13,18 +15,73 @@ const WEEKDAY_BY_INDEX = [
   "saturday",
 ] as const;
 
+type CalendarDate = { year: number; month: number; day: number };
+
+// Availability/AvailabilityOverrides times are entered by the admin in their
+// browser (Europe/Berlin) and stored as UTC instants. All wall-clock reads
+// and writes here go through Intl's Berlin timezone data (not local Date
+// accessors, and not manual UTC+1/+2 arithmetic), so the server process's
+// own timezone (this app runs in UTC in production) never leaks into the
+// computed availability — see lib/calendar/timezone.ts for the same pattern.
+function berlinParts(date: Date): CalendarDate & { hour: number; minute: number } {
+  const parts = new Intl.DateTimeFormat("en-US", {
+    timeZone: BERLIN_TZ,
+    year: "numeric",
+    month: "2-digit",
+    day: "2-digit",
+    hour: "2-digit",
+    minute: "2-digit",
+    hourCycle: "h23",
+  }).formatToParts(date);
+  const get = (type: string) => Number(parts.find((p) => p.type === type)?.value ?? "0");
+  return { year: get("year"), month: get("month"), day: get("day"), hour: get("hour"), minute: get("minute") };
+}
+
+function berlinOffsetMinutes(date: Date): number {
+  const tzName = new Intl.DateTimeFormat("en-US", { timeZone: BERLIN_TZ, timeZoneName: "shortOffset" })
+    .formatToParts(date)
+    .find((p) => p.type === "timeZoneName")?.value ?? "GMT+1";
+  const match = tzName.match(/GMT([+-]\d+)(?::(\d+))?/);
+  const hours = match ? Number(match[1]) : 1;
+  const minutes = match?.[2] ? Number(match[2]) : 0;
+  return hours * 60 + (hours < 0 ? -minutes : minutes);
+}
+
+/** Converts a Europe/Berlin wall-clock date+time into the UTC instant it represents. */
+function berlinWallTimeToUTC(date: CalendarDate, hour: number, minute: number): Date {
+  const guess = Date.UTC(date.year, date.month - 1, date.day, hour, minute);
+  return new Date(guess - berlinOffsetMinutes(new Date(guess)) * 60_000);
+}
+
 function dateKey(date: Date): string {
-  return date.toISOString().slice(0, 10);
+  const { year, month, day } = berlinParts(date);
+  return `${year}-${String(month).padStart(2, "0")}-${String(day).padStart(2, "0")}`;
+}
+
+function calendarDate(date: Date): CalendarDate {
+  const { year, month, day } = berlinParts(date);
+  return { year, month, day };
+}
+
+function addCalendarDays({ year, month, day }: CalendarDate, delta: number): CalendarDate {
+  // Pure calendar-rollover arithmetic (month/year boundaries) — no timezone
+  // conversion happens here, so using the UTC constructor is safe and simple.
+  const utc = new Date(Date.UTC(year, month - 1, day + delta));
+  return { year: utc.getUTCFullYear(), month: utc.getUTCMonth() + 1, day: utc.getUTCDate() };
+}
+
+function weekdayOf({ year, month, day }: CalendarDate): (typeof WEEKDAY_BY_INDEX)[number] {
+  return WEEKDAY_BY_INDEX[new Date(Date.UTC(year, month - 1, day)).getUTCDay()];
 }
 
 function timeOfDayMinutes(date: Date): number {
-  return date.getHours() * 60 + date.getMinutes();
+  const { hour, minute } = berlinParts(date);
+  return hour * 60 + minute;
 }
 
-function atMinutesOfDay(day: Date, minutes: number): Date {
-  const d = new Date(day);
-  d.setHours(0, Math.round(minutes), 0, 0);
-  return d;
+function atMinutesOfDay(day: CalendarDate, minutes: number): Date {
+  const rounded = Math.round(minutes);
+  return berlinWallTimeToUTC(day, Math.floor(rounded / 60), rounded % 60);
 }
 
 function overlaps(aStart: Date, aEnd: Date, bStart: Date, bEnd: Date): boolean {
@@ -67,8 +124,12 @@ export async function getAvailableSlots(
   const overridesByDate = new Map(overrides.map((o) => [dateKey(new Date(o.date)), o]));
   const now = new Date();
 
-  for (let day = new Date(from); day <= to; day = new Date(day.getTime() + 24 * 60 * 60 * 1000)) {
-    const key = dateKey(day);
+  for (
+    let day = calendarDate(from);
+    atMinutesOfDay(day, 0) <= to;
+    day = addCalendarDays(day, 1)
+  ) {
+    const key = `${day.year}-${String(day.month).padStart(2, "0")}-${String(day.day).padStart(2, "0")}`;
     const override = overridesByDate.get(key);
 
     let windows: { startMinutes: number; endMinutes: number }[] = [];
@@ -83,7 +144,7 @@ export async function getAvailableSlots(
         },
       ];
     } else {
-      const weekdayName = WEEKDAY_BY_INDEX[day.getDay()];
+      const weekdayName = weekdayOf(day);
       windows = weekly
         .filter((w) => w.weekday === weekdayName)
         .map((w) => ({