Address security review notes

- log only the error name for rejected 4xx requests (JSON.parse messages
  can quote the request body, e.g. a password)
- refuse LB_DATABASE_PATH in production; it is test-only
- fix two stale file references in the skill texts

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/db/client.ts

@@ -1,10 +1,15 @@
 import path from "node:path";
 import { createDatabaseContext } from "./database-context.js";
 
-// LB_DATABASE_PATH ist nur fuer Tests gedacht (z. B. ":memory:" in tests/security);
-// der Betrieb nutzt weiterhin data/leistungsbilanz.db.
+// LB_DATABASE_PATH ist nur fuer Tests gedacht (z. B. ":memory:" in tests/security).
+// Migrationen, Backup und Schema-Pruefung nutzen fest data/leistungsbilanz.db, deshalb
+// ist die Variable in Produktion verboten.
+const testDatabasePath = process.env.LB_DATABASE_PATH;
+if (testDatabasePath && process.env.NODE_ENV === "production") {
+  throw new Error("LB_DATABASE_PATH is test-only and must not be set in production.");
+}
 const defaultDatabaseContext = createDatabaseContext(
-  process.env.LB_DATABASE_PATH || path.resolve("data", "leistungsbilanz.db")
+  testDatabasePath || path.resolve("data", "leistungsbilanz.db")
 );
 
 export const db = defaultDatabaseContext.db;

src/server/middleware/error.middleware.ts

@@ -24,11 +24,13 @@ export function errorMiddleware(
 ) {
   const status = clientErrorStatus(error);
   if (status !== undefined) {
+    // No error message here: JSON.parse messages can quote parts of the body
+    // (for example a password from a malformed login request).
     logger.warn("request rejected", {
       method: req.method,
       path: req.originalUrl,
       status,
-      ...toErrorMeta(error),
+      errorName: error instanceof Error ? error.name : typeof error,
     });
     res.status(status).json({ error: "Ungültige Anfrage." });
     return;