Reports/Export builder (CSV/XLSX), plus a security fix pass

Adds the Berichte export pipeline (/api/export/{report,events,employees})
with shared CSV/XLSX writers in lib/export.ts and lib/reports-data.ts.

Security pass alongside it: sanitize .or() search terms against PostgREST
filter injection, sanitize spreadsheet cells against CSV/Excel formula
injection, stop leaking raw DB error messages to clients, harden the
service-role client with server-only, add baseline security headers, and
bump the vulnerable nested postcss via an override.

app/(app)/audit/page.tsx

@@ -2,6 +2,7 @@ import Link from "next/link";
 import { Suspense } from "react";
 import { AuditFilters } from "@/components/audit/AuditFilters";
 import { actionBadgeStyle } from "@/lib/colors";
+import { sanitizeIlikeTerm } from "@/lib/supabase/query";
 import { createClient } from "@/lib/supabase/server";
 
 const PAGE_SIZE = 25;
@@ -38,7 +39,7 @@ export default async function AuditPage({ searchParams }: { searchParams: Promis
 
   if (params.action) query = query.eq("action", params.action);
   if (params.q) {
-    const q = params.q.trim();
+    const q = sanitizeIlikeTerm(params.q.trim());
     query = query.or(`target_label.ilike.%${q}%,details.ilike.%${q}%,actor_name.ilike.%${q}%`);
   }