Reports/Export builder (CSV/XLSX), plus a security fix pass

Adds the Berichte export pipeline (/api/export/{report,events,employees})
with shared CSV/XLSX writers in lib/export.ts and lib/reports-data.ts.

Security pass alongside it: sanitize .or() search terms against PostgREST
filter injection, sanitize spreadsheet cells against CSV/Excel formula
injection, stop leaking raw DB error messages to clients, harden the
service-role client with server-only, add baseline security headers, and
bump the vulnerable nested postcss via an override.

lib/supabase/admin.ts

@@ -1,13 +1,12 @@
+import "server-only";
 import { createClient as createSupabaseClient } from "@supabase/supabase-js";
 import type { Database } from "./types";
 
 // Service-role client: bypasses RLS entirely. Server-only — never import this
-// from a Client Component or anything bundled for the browser.
+// from a Client Component or anything bundled for the browser. The
+// "server-only" import makes an accidental client-side import a build error
+// instead of a runtime one.
 export function createAdminClient() {
-  if (typeof window !== "undefined") {
-    throw new Error("createAdminClient must never be called in the browser");
-  }
-
   return createSupabaseClient<Database>(
     process.env.NEXT_PUBLIC_SUPABASE_URL!,
     process.env.SUPABASE_SERVICE_ROLE_KEY!,