Reports/Export builder (CSV/XLSX), plus a security fix pass

Adds the Berichte export pipeline (/api/export/{report,events,employees})
with shared CSV/XLSX writers in lib/export.ts and lib/reports-data.ts.

Security pass alongside it: sanitize .or() search terms against PostgREST
filter injection, sanitize spreadsheet cells against CSV/Excel formula
injection, stop leaking raw DB error messages to clients, harden the
service-role client with server-only, add baseline security headers, and
bump the vulnerable nested postcss via an override.

actions/positions.ts

@@ -1,6 +1,7 @@
 "use server";
 
 import { revalidatePath } from "next/cache";
+import { sanitizeIlikeTerm } from "@/lib/supabase/query";
 import { createClient } from "@/lib/supabase/server";
 
 type ActionResult = { success: boolean; error?: string };
@@ -49,7 +50,7 @@ export async function searchSuperiors(query: string, forLeadPosition: boolean):
     .limit(20);
   q = forLeadPosition ? q.lte("org_level", 1) : q.eq("is_lead", true).eq("org_level", 2);
   if (query.trim()) {
-    const term = query.trim();
+    const term = sanitizeIlikeTerm(query.trim());
     q = q.or(`first_name.ilike.%${term}%,last_name.ilike.%${term}%,job_title.ilike.%${term}%`);
   }
   const { data } = await q;