Simplify: PHP page dedup, secure UUID, input validation, remove redundant headers

- pages/*.php: 11 files reduced to 1-liners via shared renderPage() helper
- Session: UUID generation uses random_bytes() instead of mt_rand()
- Session: logout cookie uses same security options as create
- API saves: size limits on key (100) and data (500KB)
- API sessions: displayName capped at 64 chars
- API: removed redundant Content-Type headers (Response::json handles it)
- API dashboard: replaced SELECT * with explicit columns

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

App/php/api/dashboard.php

@@ -4,8 +4,6 @@
  * GET /api/dashboard?class_id=X
  */
 
-header('Content-Type: application/json; charset=utf-8');
-
 if ($_SERVER['REQUEST_METHOD'] !== 'GET') {
     Response::error('Nur GET erlaubt', 405);
 }
@@ -18,14 +16,14 @@ $classId = (int)($_GET['class_id'] ?? 0);
 // Verifizieren dass die Klasse dem Lehrer gehoert
 if ($classId) {
     $class = $db->fetchOne(
-        'SELECT * FROM classes WHERE id = ? AND teacher_id = ?',
+        'SELECT id, name, school_year, join_code, created_at FROM classes WHERE id = ? AND teacher_id = ?',
         [$classId, $teacherId]
     );
     if (!$class) Response::error('Klasse nicht gefunden', 404);
 }
 
 // Klassen des Lehrers
-$classes = $db->fetchAll('SELECT * FROM classes WHERE teacher_id = ? ORDER BY created_at DESC', [$teacherId]);
+$classes = $db->fetchAll('SELECT id, name, school_year, join_code, created_at FROM classes WHERE teacher_id = ? ORDER BY created_at DESC', [$teacherId]);
 
 if (!$classId && !empty($classes)) {
     $classId = $classes[0]['id'];