Simplify: PHP page dedup, secure UUID, input validation, remove redundant headers

- pages/*.php: 11 files reduced to 1-liners via shared renderPage() helper
- Session: UUID generation uses random_bytes() instead of mt_rand()
- Session: logout cookie uses same security options as create
- API saves: size limits on key (100) and data (500KB)
- API sessions: displayName capped at 64 chars
- API: removed redundant Content-Type headers (Response::json handles it)
- API dashboard: replaced SELECT * with explicit columns

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

App/php/api/sessions.php

@@ -5,8 +5,6 @@
  * POST /api/sessions {action: "status"}
  */
 
-header('Content-Type: application/json; charset=utf-8');
-
 if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
     Response::error('Nur POST erlaubt', 405);
 }
@@ -26,7 +24,7 @@ if ($action === 'join') {
         Response::error('Klasse nicht gefunden');
     }
 
-    $displayName = trim($body['displayName'] ?? '');
+    $displayName = mb_substr(trim($body['displayName'] ?? ''), 0, 64);
     $uuid = Session::createStudent((int)$class['id'], $displayName);
 
     Response::ok([