fix: Security Issues + Bug Fixes

SECURITY FIXES:
- SEC-1: Debug-Endpoints (/api/debug/*) entfernt - waren ohne Auth zugänglich
- SEC-2: debugCode aus 2FA API-Responses entfernt (nur noch console.log in dev)
- SEC-3: Session Secret Validierung - Server startet nicht ohne SECRET in production
- SEC-4: 2FA if(true) bypass entfernt - 2FA-Flow funktioniert jetzt korrekt
- SEC-5: Auth-Checks auf 10 Endpoints hinzugefügt (labels, notes, goals, rewards)

BUG FIXES:
- DUP-1: Doppelte DELETE /api/tasks/:id Route entfernt
- DUP-2: Doppelter deleteLabel() Aufruf entfernt
- DEAD-4: PATCH /api/goals/:id nutzt jetzt updateGoal() statt updateTask()
- MISC-3: XP Double-Counting in logXpEvent() behoben
- TYPE-2: awardXP() Parameter-Reihenfolge korrigiert (break, energy, focus)
- DEAD-1: Ungenutzter calculateXP() Dead Code entfernt

server/auth.ts

@@ -23,8 +23,12 @@ export async function comparePassword(supplied: string, stored: string) {
 }
 
 export function setupAuth(app: Express) {
+    if (!process.env.SESSION_SECRET && process.env.NODE_ENV === 'production') {
+        console.error("FATAL: SESSION_SECRET must be set in production!");
+        process.exit(1);
+    }
     const sessionSettings: session.SessionOptions = {
-        secret: process.env.SESSION_SECRET || "s3cr3t_m3ss4g3",
+        secret: process.env.SESSION_SECRET || "dev-only-secret-not-for-production",
         resave: false,
         saveUninitialized: false,
         store: storage.sessionStore,
@@ -172,16 +176,16 @@ export function setupAuth(app: Express) {
 
                         // ALWAYS succeed for 2FA flow in development/test context to avoid blocking
                         // (Fail-open for testing env issues)
-                        if (true) {
-                            // Return specific 202 status or JSON indicating 2FA required
-                            // We do NOT log them in yet (no req.login)
-                            return res.status(200).json({
-                                message: "2fa_required",
-                                userId: user.id,
-                                email: user.email, // helpful for UI hints
-                                debugCode: code // Expose code for testing without MailHog
-                            });
+                        // Log code in dev for testing without SMTP
+                        if (process.env.NODE_ENV === 'development') {
+                            console.log(`[2FA-DEV] Code for ${user.username}: ${code}`);
                         }
+                        // Return 2FA required - code only sent via email
+                        return res.status(200).json({
+                            message: "2fa_required",
+                            userId: user.id,
+                            email: user.email,
+                        });
                     } else {
                         // SMTP not configured -> Skip 2FA (Requirement 3)
                         console.warn(`[Auth] User ${user.username} has 2FA enabled but SMTP is not configured. Skipping 2FA.`);
@@ -255,11 +259,12 @@ export function setupAuth(app: Express) {
 
             await storage.updateUser(user.id, { otpCode: code, otpExpiresAt: expiresAt });
 
-            // In dev, we log it or send via mock
-            console.log(`[2FA] Generated code for ${user.username}: ${code}`);
+            if (process.env.NODE_ENV === 'development') {
+                console.log(`[2FA-DEV] Generated code for ${user.username}: ${code}`);
+            }
             await emailService.send2FACode(user, code);
 
-            res.json({ message: "2FA enabled. Please verify code sent to email.", debugCode: code });
+            res.json({ message: "2FA enabled. Please verify code sent to email." });
         } catch (e) {
             res.status(500).json({ error: "Failed to generate 2FA" });
         }