Reports/Export builder (CSV/XLSX), plus a security fix pass

Adds the Berichte export pipeline (/api/export/{report,events,employees})
with shared CSV/XLSX writers in lib/export.ts and lib/reports-data.ts.

Security pass alongside it: sanitize .or() search terms against PostgREST
filter injection, sanitize spreadsheet cells against CSV/Excel formula
injection, stop leaking raw DB error messages to clients, harden the
service-role client with server-only, add baseline security headers, and
bump the vulnerable nested postcss via an override.

app/api/cron/apply-pending-changes/route.ts

@@ -17,7 +17,8 @@ export async function GET(request: NextRequest) {
   const { data, error } = await supabase.rpc("apply_due_pending_changes");
 
   if (error) {
-    return NextResponse.json({ error: error.message }, { status: 500 });
+    console.error("apply_due_pending_changes failed:", error);
+    return NextResponse.json({ error: "Interner Fehler." }, { status: 500 });
   }
 
   return NextResponse.json({ applied: data });