Simplify: PHP page dedup, secure UUID, input validation, remove redundant headers

- pages/*.php: 11 files reduced to 1-liners via shared renderPage() helper
- Session: UUID generation uses random_bytes() instead of mt_rand()
- Session: logout cookie uses same security options as create
- API saves: size limits on key (100) and data (500KB)
- API sessions: displayName capped at 64 chars
- API: removed redundant Content-Type headers (Response::json handles it)
- API dashboard: replaced SELECT * with explicit columns

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

App/php/lib/Session.php

@@ -22,12 +22,12 @@ class Session {
 
     /** Neue Schueler-Session erstellen */
     public static function createStudent(int $classId, string $displayName = ''): string {
-        $uuid = sprintf('%04x%04x-%04x-%04x-%04x-%04x%04x%04x',
-            mt_rand(0, 0xffff), mt_rand(0, 0xffff),
-            mt_rand(0, 0xffff),
-            mt_rand(0, 0x0fff) | 0x4000,
-            mt_rand(0, 0x3fff) | 0x8000,
-            mt_rand(0, 0xffff), mt_rand(0, 0xffff), mt_rand(0, 0xffff)
+        $uuid = sprintf('%s-%s-%s-%s-%s',
+            bin2hex(random_bytes(4)),
+            bin2hex(random_bytes(2)),
+            bin2hex(random_bytes(2)),
+            bin2hex(random_bytes(2)),
+            bin2hex(random_bytes(6))
         );
 
         $db = Database::get();
@@ -83,6 +83,12 @@ class Session {
     public static function logout(): void {
         self::start();
         session_destroy();
-        setcookie(self::COOKIE_NAME, '', ['expires' => 1, 'path' => BASE_PATH . '/']);
+        setcookie(self::COOKIE_NAME, '', [
+            'expires'  => 1,
+            'path'     => BASE_PATH . '/',
+            'samesite' => 'Lax',
+            'secure'   => IS_PRODUCTION,
+            'httponly'  => true,
+        ]);
     }
 }