Simplify: PHP page dedup, secure UUID, input validation, remove redundant headers

- pages/*.php: 11 files reduced to 1-liners via shared renderPage() helper
- Session: UUID generation uses random_bytes() instead of mt_rand()
- Session: logout cookie uses same security options as create
- API saves: size limits on key (100) and data (500KB)
- API sessions: displayName capped at 64 chars
- API: removed redundant Content-Type headers (Response::json handles it)
- API dashboard: replaced SELECT * with explicit columns

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

App/pages/dashboard.php

@@ -1,5 +1 @@
-<?php
-/** GeoGraSim — Lehrkraefte-Dashboard */
-$html = file_get_contents(APP_ROOT . '/dashboard.html');
-$ctx = '<script>window.__GGS__ = ' . json_encode(['sessionId' => Session::studentId(), 'teacherId' => Session::teacherId(), 'baseUrl' => BASE_URL, 'basePath' => BASE_PATH], JSON_UNESCAPED_UNICODE) . ';</script>';
-echo str_replace('</body>', $ctx . "\n</body>", $html);
+<?php renderPage('dashboard.html');

App/pages/energiemix.php

@@ -1,5 +1 @@
-<?php
-/** GeoGraSim — Energiemix-Simulator */
-$html = file_get_contents(APP_ROOT . '/energiemix.html');
-$ctx = '<script>window.__GGS__ = ' . json_encode(['sessionId' => Session::studentId(), 'teacherId' => Session::teacherId(), 'baseUrl' => BASE_URL, 'basePath' => BASE_PATH], JSON_UNESCAPED_UNICODE) . ';</script>';
-echo str_replace('</body>', $ctx . "\n</body>", $html);
+<?php renderPage('energiemix.html');

App/pages/erdbeben.php

@@ -1,5 +1 @@
-<?php
-/** GeoGraSim — Erdbeben-Simulator */
-$html = file_get_contents(APP_ROOT . '/erdbeben.html');
-$ctx = '<script>window.__GGS__ = ' . json_encode(['sessionId' => Session::studentId(), 'teacherId' => Session::teacherId(), 'baseUrl' => BASE_URL, 'basePath' => BASE_PATH], JSON_UNESCAPED_UNICODE) . ';</script>';
-echo str_replace('</body>', $ctx . "\n</body>", $html);
+<?php renderPage('erdbeben.html');

App/pages/fluss.php

@@ -1,5 +1 @@
-<?php
-/** GeoGraSim — Flussmanagement-Simulation */
-$html = file_get_contents(APP_ROOT . '/fluss.html');
-$ctx = '<script>window.__GGS__ = ' . json_encode(['sessionId' => Session::studentId(), 'teacherId' => Session::teacherId(), 'baseUrl' => BASE_URL, 'basePath' => BASE_PATH], JSON_UNESCAPED_UNICODE) . ';</script>';
-echo str_replace('</body>', $ctx . "\n</body>", $html);
+<?php renderPage('fluss.html');

App/pages/game-3d.php

@@ -1,18 +1 @@
-<?php
-/**
- * GeoGraSim — Klimawächter (3D)
- */
-
-$html = file_get_contents(APP_ROOT . '/game-3d.html');
-
-$sessionScript = '<script>' . "\n"
-    . 'window.__GGS__ = ' . json_encode([
-        'sessionId' => Session::studentId(),
-        'teacherId' => Session::teacherId(),
-        'baseUrl'   => BASE_URL,
-        'basePath'  => BASE_PATH,
-    ], JSON_UNESCAPED_UNICODE) . ";\n"
-    . '</script>';
-
-$html = str_replace('</body>', $sessionScript . "\n</body>", $html);
-echo $html;
+<?php renderPage('game-3d.html');

App/pages/game.php

@@ -1,18 +1 @@
-<?php
-/**
- * GeoGraSim — Klimawächter (2D)
- */
-
-$html = file_get_contents(APP_ROOT . '/game.html');
-
-$sessionScript = '<script>' . "\n"
-    . 'window.__GGS__ = ' . json_encode([
-        'sessionId' => Session::studentId(),
-        'teacherId' => Session::teacherId(),
-        'baseUrl'   => BASE_URL,
-        'basePath'  => BASE_PATH,
-    ], JSON_UNESCAPED_UNICODE) . ";\n"
-    . '</script>';
-
-$html = str_replace('</body>', $sessionScript . "\n</body>", $html);
-echo $html;
+<?php renderPage('game.html');

App/pages/index.php

@@ -1,21 +1 @@
-<?php
-/**
- * GeoGraSim — Startseite (Landing Page)
- * Laedt die bestehende index.html und injiziert Session-Kontext.
- */
-
-$html = file_get_contents(APP_ROOT . '/index.html');
-
-// Session-Kontext vor </body> injizieren
-$sessionScript = '<script>' . "\n"
-    . 'window.__GGS__ = ' . json_encode([
-        'sessionId' => Session::studentId(),
-        'teacherId' => Session::teacherId(),
-        'baseUrl'   => BASE_URL,
-        'basePath'  => BASE_PATH,
-    ], JSON_UNESCAPED_UNICODE) . ";\n"
-    . '</script>';
-
-$html = str_replace('</body>', $sessionScript . "\n</body>", $html);
-
-echo $html;
+<?php renderPage('index.html');

App/pages/lieferketten.php

@@ -1,5 +1 @@
-<?php
-/** GeoGraSim — Lieferketten-Simulator */
-$html = file_get_contents(APP_ROOT . '/lieferketten.html');
-$ctx = '<script>window.__GGS__ = ' . json_encode(['sessionId' => Session::studentId(), 'teacherId' => Session::teacherId(), 'baseUrl' => BASE_URL, 'basePath' => BASE_PATH], JSON_UNESCAPED_UNICODE) . ';</script>';
-echo str_replace('</body>', $ctx . "\n</body>", $html);
+<?php renderPage('lieferketten.html');

App/pages/regenwald.php

@@ -1,5 +1 @@
-<?php
-/** GeoGraSim — Regenwald-Explorer */
-$html = file_get_contents(APP_ROOT . '/regenwald.html');
-$ctx = '<script>window.__GGS__ = ' . json_encode(['sessionId' => Session::studentId(), 'teacherId' => Session::teacherId(), 'baseUrl' => BASE_URL, 'basePath' => BASE_PATH], JSON_UNESCAPED_UNICODE) . ';</script>';
-echo str_replace('</body>', $ctx . "\n</body>", $html);
+<?php renderPage('regenwald.html');

App/pages/sim.php

@@ -1,5 +1 @@
-<?php
-/** GeoGraSim — Simulationsseite (POE-Workflow) */
-$html = file_get_contents(APP_ROOT . '/sim.html');
-$ctx = '<script>window.__GGS__ = ' . json_encode(['sessionId' => Session::studentId(), 'teacherId' => Session::teacherId(), 'baseUrl' => BASE_URL, 'basePath' => BASE_PATH], JSON_UNESCAPED_UNICODE) . ';</script>';
-echo str_replace('</body>', $ctx . "\n</body>", $html);
+<?php renderPage('sim.html');

App/pages/stilauswahl.php

@@ -1,5 +1 @@
-<?php
-/** GeoGraSim — Stilauswahl */
-$html = file_get_contents(APP_ROOT . '/stilauswahl.html');
-$ctx = '<script>window.__GGS__ = ' . json_encode(['sessionId' => Session::studentId(), 'teacherId' => Session::teacherId(), 'baseUrl' => BASE_URL, 'basePath' => BASE_PATH], JSON_UNESCAPED_UNICODE) . ';</script>';
-echo str_replace('</body>', $ctx . "\n</body>", $html);
+<?php renderPage('stilauswahl.html');