Fix security and correctness issues found in full-codebase audit

- Restrict meetingPassword field so it isn't leaked via the public REST/GraphQL API
- Fix booking slot computation to use Europe/Berlin time instead of the server's UTC clock
- Reset email verification when a customer changes their email address
- Fix ICS calendar injection via unescaped carriage returns in event descriptions
- Bind WebRTC meeting kicks to a persistent client id so they survive a rejoin
- Move the meeting signaling token out of the WebSocket query string into the first message
- Prevent duplicate signaling connections from leaking when the same participant reconnects
- Use the rightmost X-Forwarded-For entry for rate limiting (single trusted reverse proxy)
- Use constant-time comparison for the cron endpoint's bearer token
- Remove SVG from allowed Media upload types (stored-XSS risk, unused anyway)
- Add baseline security headers and a CSP to next.config.ts
- Fix CI/CD script injection via unsanitized git ref names in release.yml

lib/meeting/protocol.ts

@@ -7,6 +7,7 @@ export type ParticipantSummary = {
 };
 
 export type ClientToServerMessage =
+  | { type: "auth"; token: string }
   | { type: "offer"; to: string; payload: RTCSessionDescriptionInit }
   | { type: "answer"; to: string; payload: RTCSessionDescriptionInit }
   | { type: "ice-candidate"; to: string; payload: RTCIceCandidateInit }
@@ -19,4 +20,5 @@ export type ServerToClientMessage =
   | { type: "offer"; from: string; payload: RTCSessionDescriptionInit }
   | { type: "answer"; from: string; payload: RTCSessionDescriptionInit }
   | { type: "ice-candidate"; from: string; payload: RTCIceCandidateInit }
-  | { type: "kicked" };
+  | { type: "kicked" }
+  | { type: "auth-error"; reason: string };