Initial: RAPPORT-HOST Iteration 1 (proprietär)

Kommerzielle Hosting-/Abo-Plattform für Rapport-Instanzen.

- React-Frontend (Vite/JSX): Landing, Register, Login, Plans, Dashboard
- Node/Express-Backend: Auth (bcrypt+JWT), Stripe-Billing, Provisioning
- HOST-Postgres-Schema: accounts, subscriptions, instances
- Provisioning-Interface + Modell-A-Adapter (Studio im geteilten Stack)
- MOCK-Modus: voller End-to-End-Flow ohne Stripe/Rapport-Stack testbar
- Idempotentes Fulfillment (Upsert auf stripe_subscription_id)
- docker-compose für lokale host-db; identisch auf Hetzner deploybar

E2E lokal verifiziert: Register -> Checkout(mock) -> Instanz -> Idempotenz.

Lizenz: proprietär (kein AGPL-Code eingebunden, nur Netzwerk-API zur Familie).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/routes/auth.js

@@ -0,0 +1,34 @@
+// HOST-Konten: Registrierung + Login. Gibt ein JWT zurück.
+import { Router } from "express";
+import { one } from "../db.js";
+import { hashPassword, verifyPassword, signToken } from "../auth.js";
+
+export const authRouter = Router();
+
+const isEmail = (s) => /.+@.+\..+/.test(s || "");
+
+authRouter.post("/register", async (req, res) => {
+  const { email, password } = req.body || {};
+  if (!isEmail(email)) return res.status(400).json({ error: "Ungültige Email." });
+  if (!password || password.length < 8) return res.status(400).json({ error: "Passwort min. 8 Zeichen." });
+
+  const existing = await one("select id from accounts where email = $1", [email.toLowerCase()]);
+  if (existing) return res.status(409).json({ error: "Konto existiert bereits." });
+
+  const account = await one(
+    "insert into accounts (email, password_hash) values ($1, $2) returning id, email",
+    [email.toLowerCase(), await hashPassword(password)]
+  );
+  res.json({ token: signToken(account), account: { id: account.id, email: account.email } });
+});
+
+authRouter.post("/login", async (req, res) => {
+  const { email, password } = req.body || {};
+  const account = await one("select id, email, password_hash from accounts where email = $1", [
+    (email || "").toLowerCase(),
+  ]);
+  if (!account || !(await verifyPassword(password || "", account.password_hash))) {
+    return res.status(401).json({ error: "Email oder Passwort falsch." });
+  }
+  res.json({ token: signToken(account), account: { id: account.id, email: account.email } });
+});