Reports/Export builder (CSV/XLSX), plus a security fix pass

Adds the Berichte export pipeline (/api/export/{report,events,employees})
with shared CSV/XLSX writers in lib/export.ts and lib/reports-data.ts.

Security pass alongside it: sanitize .or() search terms against PostgREST
filter injection, sanitize spreadsheet cells against CSV/Excel formula
injection, stop leaking raw DB error messages to clients, harden the
service-role client with server-only, add baseline security headers, and
bump the vulnerable nested postcss via an override.

actions/employees.ts

@@ -1,6 +1,7 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
+import { sanitizeIlikeTerm } from "@/lib/supabase/query";
 import { createClient } from "@/lib/supabase/server";
 import type { Database } from "@/lib/supabase/types";
 
@@ -122,7 +123,7 @@ export async function searchActiveEmployees(query: string): Promise<EmployeeSear
     .in("status", ["Aktiv", "Karenz"])
     .limit(20);
   if (query.trim()) {
-    const term = query.trim();
+    const term = sanitizeIlikeTerm(query.trim());
     q = q.or(`first_name.ilike.%${term}%,last_name.ilike.%${term}%,job_title.ilike.%${term}%`);
   }
   const { data } = await q;