From cde87db064722adbd943819d12b5418f18f8e44a Mon Sep 17 00:00:00 2001
From: Philipp Urbschat <philipp.urbschat@gmail.com>
Date: Sat, 12 Sep 2026 22:14:58 +0200
Subject: [PATCH] security: protect API keys with backend proxy, harden auth,
 htaccess and session management

---
 .htaccess                                |   15 +-
 auth.php                                 |    1 +
 dinos/api_proxy.php                      |   92 ++
 dinos/auth.php                           |    9 +
 dinos/index.php                          |   86 +-
 dinos/test.html                          | 1049 ----------------------
 home/app/controllers/LoginController.php |    2 +
 home/app/init.php                        |    1 +
 home/core/Controller.php                 |   10 +-
 home/core/Router.php                     |    5 +-
 home/core/Security.php                   |    2 +-
 home/public/index.php                    |    5 +-
 philcore/app/init.php                    |    7 +-
 philcore/core/Controller.php             |   18 +-
 philcore/core/Router.php                 |    5 +-
 philcore/core/Security.php               |    2 +-
 plants/api.php                           |    4 +-
 plants/auth_api.php                      |    3 +-
 plants/test.html                         |   82 --
 plants/test_prompt.php                   |  228 -----
 test/index.html                          |   22 -
 21 files changed, 190 insertions(+), 1458 deletions(-)
 create mode 100644 dinos/api_proxy.php
 delete mode 100644 dinos/test.html
 delete mode 100644 plants/test.html
 delete mode 100644 plants/test_prompt.php
 delete mode 100644 test/index.html

diff --git a/.htaccess b/.htaccess
index 272f275..f40a73c 100644
--- a/.htaccess
+++ b/.htaccess
@@ -2,17 +2,26 @@
 Options -Indexes
 RewriteEngine On
 
-# Interne PHP- und Template-Verzeichnisse vor direktem Webzugriff sperren
+# HTTP Security Headers
+<IfModule mod_headers.c>
+    Header always set X-Frame-Options "SAMEORIGIN"
+    Header always set X-Content-Type-Options "nosniff"
+    Header always set Referrer-Policy "strict-origin-when-cross-origin"
+</IfModule>
+
+# Interne PHP-, Vendor- und Template-Verzeichnisse vor direktem Webzugriff sperren
 RewriteRule ^(home|philcore)/(app|core|views|src)/ - [F,L]
+RewriteRule ^(.*/)?vendor/ - [F,L]
 
 # Sensible Dateien und Verzeichnisse vor direktem Webzugriff schützen
 <FilesMatch "(^\.|\.(json|lock|sql|env|md)$)">
     Require all denied
 </FilesMatch>
 
-<Files "auth.php">
+# Interne Hilfsdateien vor direktem Aufruf schützen
+<FilesMatch "^(auth\.php|db\.php|google_helper\.php)$">
     Require all denied
-</Files>
+</FilesMatch>
 
 # 1. Assets aus home/public weiterleiten (falls direkt aufgerufen wie /css/style.css)
 RewriteCond %{REQUEST_FILENAME} !-f
diff --git a/auth.php b/auth.php
index 95a3f21..6a41921 100644
--- a/auth.php
+++ b/auth.php
@@ -6,6 +6,7 @@ if (session_status() === PHP_SESSION_NONE) {
     session_set_cookie_params([
         'path' => '/',
         'httponly' => true,
+        'secure' => (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off'),
         'samesite' => 'Lax' // Lax erlaubt den Wechsel zwischen /home und /test
     ]);
     session_start();
diff --git a/dinos/api_proxy.php b/dinos/api_proxy.php
new file mode 100644
index 0000000..3500eb5
--- /dev/null
+++ b/dinos/api_proxy.php
@@ -0,0 +1,92 @@
+<?php
+// DATEI: dinos/api_proxy.php
+
+$current_project = 'dinos';
+require_once __DIR__ . '/../auth.php';
+
+header('Content-Type: application/json');
+
+if ($_SERVER['REQUEST_METHOD'] !== 'POST') {
+    http_response_code(405);
+    echo json_encode(['error' => 'Nur POST-Anfragen sind erlaubt.']);
+    exit;
+}
+
+// 1. API-Schlüssel sicher aus .env laden
+$apiKey = '';
+$envFiles = [__DIR__ . '/.env', __DIR__ . '/../home/.env'];
+foreach ($envFiles as $envFile) {
+    if (file_exists($envFile)) {
+        foreach (file($envFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) as $line) {
+            $line = trim($line);
+            if ($line === '' || $line[0] === '#') continue;
+            if (strpos($line, '=') !== false) {
+                list($k, $v) = explode('=', $line, 2);
+                if (trim($k) === 'GEMINI_API_KEY') {
+                    $apiKey = trim(trim($v), '"\'');
+                    break 2;
+                }
+            }
+        }
+    }
+}
+
+if (empty($apiKey)) {
+    http_response_code(500);
+    echo json_encode(['error' => 'API-Schlüssel nicht konfiguriert.']);
+    exit;
+}
+
+// 2. JSON-Daten empfangen
+$json_input = file_get_contents('php://input');
+$request_data = json_decode($json_input, true);
+
+if (json_last_error() !== JSON_ERROR_NONE || !isset($request_data['apiUrl']) || !isset($request_data['payload'])) {
+    http_response_code(400);
+    echo json_encode(['error' => 'Ungültige Anfrage-Daten.']);
+    exit;
+}
+
+$apiUrl = $request_data['apiUrl'];
+$payload = $request_data['payload'];
+
+// 3. SSRF-Schutz: Nur generativelanguage.googleapis.com erlauben
+$parsed = parse_url($apiUrl);
+if (!isset($parsed['host']) || $parsed['host'] !== 'generativelanguage.googleapis.com') {
+    http_response_code(403);
+    echo json_encode(['error' => 'Ungültiges API-Ziel.']);
+    exit;
+}
+
+// 4. Ziel-URL mit API-Schlüssel zusammensetzen
+$separator = (strpos($apiUrl, '?') !== false) ? '&' : '?';
+$fullApiUrl = $apiUrl . $separator . 'key=' . $apiKey;
+
+// 5. Anfrage mit cURL an Google API senden
+$ch = curl_init();
+
+curl_setopt_array($ch, [
+    CURLOPT_URL            => $fullApiUrl,
+    CURLOPT_RETURNTRANSFER => true,
+    CURLOPT_POST           => true,
+    CURLOPT_POSTFIELDS     => json_encode($payload),
+    CURLOPT_HTTPHEADER     => [
+        'Content-Type: application/json',
+    ],
+    CURLOPT_TIMEOUT        => 90,
+]);
+
+$response_body = curl_exec($ch);
+$http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
+
+if (curl_errno($ch)) {
+    http_response_code(500);
+    echo json_encode(['error' => 'Fehler bei Weiterleitung an Google: ' . curl_error($ch)]);
+    exit;
+}
+
+curl_close($ch);
+
+http_response_code($http_code);
+echo $response_body;
+?>
diff --git a/dinos/auth.php b/dinos/auth.php
index 840f793..812819e 100644
--- a/dinos/auth.php
+++ b/dinos/auth.php
@@ -5,6 +5,15 @@
  * Führt den Google Login durch und speichert den Token.
  */
 
+$current_project = 'dinos';
+require_once __DIR__ . '/../auth.php';
+
+// Nur Administratoren dürfen Google OAuth Konten verknüpfen
+if (!isset($_SESSION['is_admin']) || $_SESSION['is_admin'] !== true) {
+    header('Location: /');
+    exit();
+}
+
 require_once 'google_helper.php';
 
 // Konfiguration
diff --git a/dinos/index.php b/dinos/index.php
index 0d44e53..ba49f6f 100644
--- a/dinos/index.php
+++ b/dinos/index.php
@@ -16,25 +16,6 @@ $dailyLimitEco = 100; // Eco (Flash) etwa 3-4 Cent pro Bild
 $dailyLimitPro = 10;  // Pro (Imagen 4) etwa 3-4 Cent pro Bild
 $dailyLimitUltra = 10; // Ultra (Gemini 3) etwa 12 Cent pro Bild
 
-// API-Key sicher aus .env laden
-$apiKey = '';
-$envFiles = [__DIR__ . '/.env', __DIR__ . '/../home/.env'];
-foreach ($envFiles as $envFile) {
-    if (file_exists($envFile)) {
-        foreach (file($envFile, FILE_IGNORE_NEW_LINES | FILE_SKIP_EMPTY_LINES) as $line) {
-            $line = trim($line);
-            if ($line === '' || $line[0] === '#') continue;
-            if (strpos($line, '=') !== false) {
-                list($k, $v) = explode('=', $line, 2);
-                if (trim($k) === 'GEMINI_API_KEY') {
-                    $apiKey = trim(trim($v), '"\'');
-                    break 2;
-                }
-            }
-        }
-    }
-}
-
 // API Modelle (hier zentral ändern, wenn Versionen veralten) siehe apis.php
 $modelText = "gemini-2.5-flash";      // Für Fakten und Zufallsgenerator
 $modelImageEco = "gemini-2.5-flash-image";  // ECO Modus
@@ -316,7 +297,6 @@ $totalUltra = $currentStats['total_ultra'];
 
     <script>
         // API Konfiguration ans Frontend übergeben
-        const apiKey = "<?php echo $apiKey; ?>";
         const apiModels = {
             text: "<?php echo $modelText; ?>",
             imageEco: "<?php echo $modelImageEco; ?>",
@@ -475,11 +455,6 @@ $totalUltra = $currentStats['total_ultra'];
 
         // --- ZUFALLSGENERATOR LOGIK ---
         async function handleRandomDino() {
-            if (!apiKey) {
-                showError("API Key fehlt.");
-                return;
-            }
-
             let diceIconElem = document.getElementById('diceIcon');
             if (!diceIconElem) diceIconElem = randomBtn.querySelector('svg');
 
@@ -488,21 +463,22 @@ $totalUltra = $currentStats['total_ultra'];
             try {
                 const prompt = DinoPrompts.getRandom();
 
-                const response = await fetch(
-                    `https://generativelanguage.googleapis.com/v1beta/models/${apiModels.text}:generateContent?key=${apiKey}`, {
-                        method: 'POST',
-                        headers: {
-                            'Content-Type': 'application/json'
-                        },
-                        body: JSON.stringify({
+                const response = await fetch('api_proxy.php', {
+                    method: 'POST',
+                    headers: {
+                        'Content-Type': 'application/json'
+                    },
+                    body: JSON.stringify({
+                        apiUrl: `https://generativelanguage.googleapis.com/v1beta/models/${apiModels.text}:generateContent`,
+                        payload: {
                             contents: [{
                                 parts: [{
                                     text: prompt
                                 }]
                             }]
-                        })
-                    }
-                );
+                        }
+                    })
+                });
 
                 if (!response.ok) throw new Error("Netzwerkfehler");
                 const result = await response.json();
@@ -551,10 +527,6 @@ $totalUltra = $currentStats['total_ultra'];
 
             const searchTerm = searchTermInput.value.trim();
             if (!searchTerm) return;
-            if (!apiKey) {
-                showError("API Key fehlt.");
-                return;
-            }
             if (typeof DinoPrompts === 'undefined') {
                 showError("Fehler: prompts.js nicht geladen.");
                 return;
@@ -667,21 +639,22 @@ $totalUltra = $currentStats['total_ultra'];
 
         async function fetchDinoFacts(term) {
             const factsPrompt = DinoPrompts.getFacts(term);
-            const response = await fetch(
-                `https://generativelanguage.googleapis.com/v1beta/models/${apiModels.text}:generateContent?key=${apiKey}`, {
-                    method: 'POST',
-                    headers: {
-                        'Content-Type': 'application/json'
-                    },
-                    body: JSON.stringify({
+            const response = await fetch('api_proxy.php', {
+                method: 'POST',
+                headers: {
+                    'Content-Type': 'application/json'
+                },
+                body: JSON.stringify({
+                    apiUrl: `https://generativelanguage.googleapis.com/v1beta/models/${apiModels.text}:generateContent`,
+                    payload: {
                         contents: [{
                             parts: [{
                                 text: factsPrompt
                             }]
                         }]
-                    })
-                }
-            );
+                    }
+                })
+            });
             if (!response.ok) {
                 const errText = await response.text();
                 if (response.status === 429 || errText.includes('RESOURCE_EXHAUSTED')) {
@@ -708,12 +681,12 @@ $totalUltra = $currentStats['total_ultra'];
         async function fetchDinoImage(dinoData, type, attempt = 1) {
             const imagePrompt = DinoPrompts.getImage(dinoData);
 
-            let url = '';
+            let apiUrl = '';
             let payload = {};
             let isImagen = false;
 
             if (type === 'ultra') {
-                url = `https://generativelanguage.googleapis.com/v1beta/models/${apiModels.imageUltra}:generateContent?key=${apiKey}`;
+                apiUrl = `https://generativelanguage.googleapis.com/v1beta/models/${apiModels.imageUltra}:generateContent`;
                 payload = {
                     contents: [{
                         parts: [{
@@ -725,7 +698,7 @@ $totalUltra = $currentStats['total_ultra'];
                     }
                 };
             } else if (type === 'pro') {
-                url = `https://generativelanguage.googleapis.com/v1beta/models/${apiModels.imagePro}:predict?key=${apiKey}`;
+                apiUrl = `https://generativelanguage.googleapis.com/v1beta/models/${apiModels.imagePro}:predict`;
                 payload = {
                     instances: [{
                         prompt: imagePrompt
@@ -736,7 +709,7 @@ $totalUltra = $currentStats['total_ultra'];
                 };
                 isImagen = true;
             } else {
-                url = `https://generativelanguage.googleapis.com/v1beta/models/${apiModels.imageEco}:generateContent?key=${apiKey}`;
+                apiUrl = `https://generativelanguage.googleapis.com/v1beta/models/${apiModels.imageEco}:generateContent`;
                 payload = {
                     contents: [{
                         parts: [{
@@ -750,12 +723,15 @@ $totalUltra = $currentStats['total_ultra'];
             }
 
             try {
-                const response = await fetch(url, {
+                const response = await fetch('api_proxy.php', {
                     method: 'POST',
                     headers: {
                         'Content-Type': 'application/json'
                     },
-                    body: JSON.stringify(payload)
+                    body: JSON.stringify({
+                        apiUrl: apiUrl,
+                        payload: payload
+                    })
                 });
 
                 if (!response.ok) {
diff --git a/dinos/test.html b/dinos/test.html
deleted file mode 100644
index 451d5f8..0000000
--- a/dinos/test.html
+++ /dev/null
@@ -1,1049 +0,0 @@
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Dino Wissenskarten Generator</title>
-
-    <script src="https://cdn.tailwindcss.com"></script>
-    <script src="https://unpkg.com/lucide@latest"></script>
-    <script src="prompts.js?v=<?php echo time(); ?>"></script>
-
-    <style>
-        .loader {
-            border: 3px solid #0f172a;
-            border-radius: 50%;
-            border-top: 3px solid transparent;
-            width: 24px;
-            height: 24px;
-            animation: spin 1s linear infinite;
-        }
-
-        @keyframes spin {
-            0% {
-                transform: rotate(0deg);
-            }
-
-            100% {
-                transform: rotate(360deg);
-            }
-        }
-
-        #renderCanvas {
-            display: none;
-        }
-
-        /* Custom Radio Buttons Look */
-        .model-option input:checked+div {
-            background-color: #f59e0b;
-            /* Amber 500 */
-            border-color: #f59e0b;
-            color: #0f172a;
-            /* Slate 900 */
-        }
-
-        .model-option:hover div {
-            border-color: #f59e0b;
-        }
-    </style>
-</head>
-
-<body class="min-h-screen bg-slate-900 font-sans text-slate-100 flex flex-col">
-
-    <div class="max-w-6xl mx-auto p-4 md:p-8 flex-grow w-full">
-
-        <!-- Header -->
-        <div class="text-center mb-8 relative">
-            <div class="absolute top-0 right-0 text-xs text-slate-600 hidden md:block">
-                User:
-                <?php echo htmlspecialchars($loggedInUser); ?>
-            </div>
-            <h1 class="text-4xl font-bold mb-2 flex items-center justify-center gap-3">
-                <span class="text-4xl">🦕</span>
-                <span class="text-transparent bg-clip-text bg-gradient-to-r from-amber-400 to-orange-500">
-                    Dino Wissenskarten
-                </span>
-            </h1>
-            <p class="text-slate-400">Generiere fotorealistische Bilder und entdecke spannende Fakten.</p>
-        </div>
-
-        <!-- Input Section -->
-        <div class="bg-slate-800 rounded-2xl shadow-2xl p-6 mb-8 border border-slate-700">
-            <div class="flex flex-col md:flex-row gap-4 items-stretch">
-
-                <!-- 1. Zufallsgenerator Button -->
-                <button id="randomBtn"
-                    class="w-full md:w-auto aspect-auto md:aspect-square px-4 md:p-0 rounded-xl hover:bg-slate-600 text-amber-400 transition-colors flex md:flex-col items-center justify-center gap-1 border border-slate-600 h-14 md:h-auto min-w-[70px]"
-                    title="Zufälliges Urzeit-Tier vorschlagen">
-                    <i id="diceIcon" data-lucide="dices" width="24" height="24"></i>
-                    <span
-                        class="text-[10px] font-normal opacity-70 uppercase tracking-wide text-slate-300">Zufall</span>
-                </button>
-
-                <!-- 2. Eingabefeld -->
-                <div class="relative flex-1 group">
-                    <input type="text" id="searchTerm" placeholder="Welcher Dino? (z.B. Triceratops)"
-                        class="w-full text-lg p-4 pb-8 bg-slate-900 border border-slate-700 text-white rounded-xl focus:ring-2 focus:ring-amber-500 outline-none transition-all placeholder:text-slate-600 h-full" />
-                    <div id="randomTagline"
-                        class="absolute left-4 bottom-2 text-xs text-slate-500 italic pointer-events-none hidden transition-opacity">
-                    </div>
-                    <button id="clearBtn"
-                        class="absolute right-4 top-1/2 -translate-y-1/2 text-slate-500 hover:text-white transition-colors p-1 hidden"
-                        title="Eingabe löschen"><i data-lucide="x" width="20"></i></button>
-                </div>
-
-                <!-- 3. Generieren & Optionen -->
-                <div class="flex flex-col gap-3 min-w-[280px]">
-                    <button id="generateBtn"
-                        class="px-8 py-3 rounded-xl text-lg font-bold text-slate-900 shadow-lg transition-all flex items-center gap-2 justify-center bg-gradient-to-r from-amber-400 to-orange-500 hover:scale-105 hover:shadow-amber-500/20 disabled:opacity-50 disabled:cursor-not-allowed disabled:hover:scale-100 flex-1">
-                        <span id="btnIcon"><i data-lucide="camera" width="24"></i></span>
-                        <span id="btnText">Erstellen</span>
-                        <div id="btnLoader" class="loader hidden"></div>
-                    </button>
-
-                    <!-- Modell Auswahl (3-Way) - SORTIERT: ECO > PRO > ULTRA -->
-                    <div class="flex gap-2 justify-between">
-                        <label class="model-option cursor-pointer flex-1">
-                            <input type="radio" name="model" value="eco" class="hidden" checked>
-                            <div
-                                class="border border-slate-600 rounded-lg p-2 text-center text-xs font-bold text-slate-400 transition-all">
-                                ECO<br><span class="text-[10px] font-normal opacity-70">Flash</span>
-                            </div>
-                        </label>
-                        <label class="model-option cursor-pointer flex-1">
-                            <input type="radio" name="model" value="pro" class="hidden">
-                            <div
-                                class="border border-slate-600 rounded-lg p-2 text-center text-xs font-bold text-slate-400 transition-all">
-                                PRO<br><span class="text-[10px] font-normal opacity-70">Imagen 4</span>
-                            </div>
-                        </label>
-                        <label class="model-option cursor-pointer flex-1">
-                            <input type="radio" name="model" value="ultra" class="hidden">
-                            <div
-                                class="border border-slate-600 rounded-lg p-2 text-center text-xs font-bold text-slate-400 transition-all">
-                                ULTRA<br><span class="text-[10px] font-normal opacity-70">Gemini 3</span>
-                            </div>
-                        </label>
-                    </div>
-                </div>
-            </div>
-            <!-- Status Meldung -->
-            <div id="statusMessage" class="mt-4 text-center text-amber-400 text-sm animate-pulse hidden"></div>
-        </div>
-
-        <!-- Fehler Anzeige -->
-        <div id="errorBox"
-            class="bg-red-900/30 text-red-400 p-4 rounded-xl mb-8 border border-red-900/50 flex items-center gap-2 hidden">
-            <i data-lucide="info" width="20"></i> <span id="errorText"></span>
-        </div>
-
-        <!-- Preview Section -->
-        <div id="previewSection" class="hidden animate-in fade-in slide-in-from-bottom-4 duration-700">
-
-            <div class="rounded-2xl overflow-hidden shadow-2xl border border-slate-700 relative group">
-                <img id="previewImage" src="" alt="Vorschau" class="w-full h-auto" />
-                <!-- Qualitäts-Badge auf dem Bild -->
-                <div id="qualityBadge"
-                    class="absolute top-4 right-4 bg-black/60 backdrop-blur text-white text-xs px-2 py-1 rounded border border-white/20 hidden">
-                    MODE
-                </div>
-            </div>
-
-            <div class="flex justify-end items-center mt-4">
-
-                <div class="flex gap-3">
-
-
-
-                    <button id="shareBtn"
-                        class="bg-slate-700 hover:bg-slate-600 text-white px-4 py-2 rounded-lg font-bold transition-colors flex items-center gap-2 shadow-lg hidden"
-                        title="Direkt teilen">
-                        <i data-lucide="share-2" width="20"></i> <span class="hidden sm:inline">Teilen</span>
-                    </button>
-                    <!-- NEU: Cloud Upload Button mit Wrapper für Icon -->
-                    <button id="uploadCloudBtn"
-                        class="bg-blue-600 hover:bg-blue-500 text-white px-6 py-2 rounded-lg font-bold transition-colors flex items-center gap-2 shadow-lg shadow-blue-600/20">
-                        <span id="uploadIconWrapper">
-                            <i data-lucide="cloud-upload" width="20"></i>
-                        </span>
-                        <span id="uploadText">Auf Nest Hub</span>
-                        <div id="uploadLoader" class="loader border-white hidden" style="width:16px; height:16px;">
-                        </div>
-                    </button>
-                    <button id="downloadBtn"
-                        class="bg-amber-500 hover:bg-amber-400 text-slate-900 px-6 py-2 rounded-lg font-bold transition-colors flex items-center gap-2 shadow-lg shadow-amber-500/10">
-                        <i data-lucide="download" width="20"></i> Speichern
-                    </button>
-                </div>
-            </div>
-        </div>
-
-        <!-- Empty State -->
-        <div id="emptyState" class="text-center py-20 opacity-50">
-            <div
-                class="w-32 h-32 bg-slate-800 rounded-full mx-auto flex items-center justify-center mb-6 border-4 border-slate-700">
-                <span class="text-6xl">🦖</span>
-            </div>
-            <p class="text-slate-400 text-lg">Tippe einen Dino-Namen ein und schau zu, was passiert.</p>
-        </div>
-    </div>
-
-    <!-- Footer mit Nutzungsstatistik -->
-    <footer class="text-center p-4 border-t border-slate-800 text-slate-600 text-xs font-mono">
-        <span class="text-amber-500/50">Statistik - Heute:</span>
-        <span id="statTodayEco" class="text-slate-300">
-            <?php echo $todayEco; ?>
-        </span> Eco |
-        <span id="statTodayPro" class="text-amber-400">
-            <?php echo $todayPro; ?>
-        </span> Pro |
-        <span id="statTodayUltra" class="text-pink-400">
-            <?php echo $todayUltra; ?>
-        </span> Ultra
-        <br class="sm:hidden">
-        <span class="text-slate-700 mx-2 hidden sm:inline">|</span>
-        <span class="text-amber-500/50">Gesamt:</span>
-        <span id="statTotalEco" class="text-slate-300">
-            <?php echo $totalEco; ?>
-        </span> Eco |
-        <span id="statTotalPro" class="text-amber-400">
-            <?php echo $totalPro; ?>
-        </span> Pro |
-        <span id="statTotalUltra" class="text-pink-400">
-            <?php echo $totalUltra; ?>
-        </span> Ultra
-    </footer>
-
-    <canvas id="renderCanvas"></canvas>
-
-    <script>
-        const apiKey = "<?php echo $apiKey; ?>";
-        // Limits
-        const limits = {
-            eco: <? php echo $dailyLimitEco; ?>,
-            pro: <?php echo $dailyLimitPro; ?>,
-                ultra: <? php echo $dailyLimitUltra; ?>
-        };
-        // Aktuelle Zähler
-        const currentCounts = {
-            eco: <? php echo $todayEco; ?>,
-            pro: <?php echo $todayPro; ?>,
-                ultra: <? php echo $todayUltra; ?>
-        };
-
-        const searchTermInput = document.getElementById('searchTerm');
-        const clearBtn = document.getElementById('clearBtn');
-        const randomBtn = document.getElementById('randomBtn');
-        const generateBtn = document.getElementById('generateBtn');
-        const btnText = document.getElementById('btnText');
-        const btnIcon = document.getElementById('btnIcon');
-        const btnLoader = document.getElementById('btnLoader');
-
-        const modelRadios = document.getElementsByName('model');
-        const qualityBadge = document.getElementById('qualityBadge');
-
-        const statusMessage = document.getElementById('statusMessage');
-        const randomTagline = document.getElementById('randomTagline');
-        const errorBox = document.getElementById('errorBox');
-        const errorText = document.getElementById('errorText');
-        const previewSection = document.getElementById('previewSection');
-        const previewImage = document.getElementById('previewImage');
-        const emptyState = document.getElementById('emptyState');
-        const downloadBtn = document.getElementById('downloadBtn');
-        const shareBtn = document.getElementById('shareBtn');
-        const canvas = document.getElementById('renderCanvas');
-
-        // Statistik Elemente
-        const statElems = {
-            eco: document.getElementById('statTodayEco'),
-            pro: document.getElementById('statTodayPro'),
-            ultra: document.getElementById('statTodayUltra'),
-            totalEco: document.getElementById('statTotalEco'),
-            totalPro: document.getElementById('statTotalPro'),
-            totalUltra: document.getElementById('statTotalUltra')
-        };
-
-        let currentDinoData = null;
-        let isResultVisible = false;
-        let activeModelType = 'eco'; // eco, pro, ultra
-
-        lucide.createIcons();
-
-        if (navigator.share && navigator.canShare) {
-            shareBtn.classList.remove('hidden');
-        }
-
-        searchTermInput.addEventListener('input', () => {
-            if (searchTermInput.value.length > 0) clearBtn.classList.remove('hidden');
-            else clearBtn.classList.add('hidden');
-            randomTagline.classList.add('hidden');
-            updateButtonState();
-        });
-
-        searchTermInput.addEventListener('keydown', (e) => {
-            if (e.key === 'Enter') handleGenerate();
-        });
-
-        clearBtn.addEventListener('click', () => {
-            searchTermInput.value = '';
-            clearBtn.classList.add('hidden');
-            randomTagline.classList.add('hidden');
-            resetUI();
-            updateButtonState();
-        });
-
-        generateBtn.addEventListener('click', handleGenerate);
-        randomBtn.addEventListener('click', handleRandomDino);
-
-        function getSelectedModel() {
-            for (const radio of modelRadios) {
-                if (radio.checked) return radio.value;
-            }
-            return 'eco';
-        }
-
-        function getFilename() {
-            if (!currentDinoData) return 'dino.png';
-            const cleanName = currentDinoData.name.replace(/\s+/g, '-');
-            let suffix = '';
-            if (activeModelType === 'pro') suffix = '-Pro';
-            if (activeModelType === 'ultra') suffix = '-Ultra';
-            return `${cleanName}${suffix}.png`;
-        }
-
-        downloadBtn.addEventListener('click', () => {
-            if (!currentDinoData || !previewImage.src) return;
-            const link = document.createElement('a');
-            link.download = getFilename();
-            link.href = previewImage.src;
-            link.click();
-        });
-
-        shareBtn.addEventListener('click', async () => {
-            if (!currentDinoData || !previewImage.src) return;
-            try {
-                const response = await fetch(previewImage.src);
-                const blob = await response.blob();
-                const fileName = getFilename();
-                const file = new File([blob], fileName, {
-                    type: 'image/png'
-                });
-                const shareData = {
-                    files: [file],
-                    title: `Wissenskarte: ${currentDinoData.name}`,
-                    text: `Hier ist eine Wissenskarte für ${currentDinoData.name}.`
-                };
-                if (navigator.canShare(shareData)) await navigator.share(shareData);
-                else alert("Teilen nicht unterstützt.");
-            } catch (err) {
-                if (err.name !== 'AbortError') {
-                    console.error(err);
-                    alert("Fehler: " + err.message);
-                }
-            }
-        });
-
-        function updateButtonState() {
-            if (isResultVisible) {
-                btnText.innerText = "Neue Variante";
-                btnIcon.innerHTML = '<i data-lucide="refresh-cw" width="24"></i>';
-                lucide.createIcons();
-                generateBtn.disabled = false;
-            } else {
-                btnText.innerText = "Erstellen";
-                btnIcon.innerHTML = '<i data-lucide="camera" width="24"></i>';
-                lucide.createIcons();
-                generateBtn.disabled = searchTermInput.value.trim() === '';
-            }
-        }
-
-        function resetUI() {
-            currentDinoData = null;
-            isResultVisible = false;
-            previewSection.classList.add('hidden');
-            emptyState.classList.remove('hidden');
-            errorBox.classList.add('hidden');
-            statusMessage.classList.add('hidden');
-            updateButtonState();
-        }
-
-        // --- ZUFALLSGENERATOR LOGIK ---
-        async function handleRandomDino() {
-            if (!apiKey) {
-                showError("API Key fehlt.");
-                return;
-            }
-
-            let diceIconElem = document.getElementById('diceIcon');
-            if (!diceIconElem) diceIconElem = randomBtn.querySelector('svg');
-
-            if (diceIconElem) diceIconElem.classList.add('animate-spin');
-
-            try {
-                const prompt = DinoPrompts.getRandom();
-
-                const response = await fetch(
-                    `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash-preview-09-2025:generateContent?key=${apiKey}`, {
-                    method: 'POST',
-                    headers: {
-                        'Content-Type': 'application/json'
-                    },
-                    body: JSON.stringify({
-                        contents: [{
-                            parts: [{
-                                text: prompt
-                            }]
-                        }]
-                    })
-                }
-                );
-
-                if (!response.ok) throw new Error("Netzwerkfehler");
-                const result = await response.json();
-                const textContent = result.candidates?.[0]?.content?.parts?.[0]?.text;
-                if (!textContent) throw new Error("Keine Daten");
-
-                // --- FIX 1: Robustes JSON Parsing ---
-                // Sucht einfach nach dem ersten { und dem letzten } im Text
-                const firstBrace = textContent.indexOf('{');
-                const lastBrace = textContent.lastIndexOf('}');
-
-                if (firstBrace === -1 || lastBrace === -1) {
-                    throw new Error("Ungültiges JSON-Format von KI erhalten.");
-                }
-
-                // Alles davor und danach (z.B. "Hier ist dein JSON:" oder ```json) wird ignoriert
-                const jsonStr = textContent.substring(firstBrace, lastBrace + 1);
-                const data = JSON.parse(jsonStr);
-
-                searchTermInput.value = data.name;
-                randomTagline.innerText = data.tagline || "";
-                randomTagline.classList.remove('hidden');
-                clearBtn.classList.remove('hidden');
-
-                resetUI();
-                updateButtonState();
-
-            } catch (err) {
-                console.error(err);
-                showError("Zufallsgenerator Fehler: " + err.message);
-            } finally {
-                let currentDiceIcon = document.getElementById('diceIcon');
-                if (!currentDiceIcon) currentDiceIcon = randomBtn.querySelector('svg');
-                if (currentDiceIcon) currentDiceIcon.classList.remove('animate-spin');
-            }
-        }
-
-        async function handleGenerate() {
-            const selectedType = getSelectedModel();
-            randomTagline.classList.add('hidden');
-
-            if (currentCounts[selectedType] >= limits[selectedType]) {
-                showError(`Tageslimit für ${selectedType.toUpperCase()}-Bilder erreicht (${limits[selectedType]}). Wähle einen anderen Modus.`);
-                return;
-            }
-
-            const searchTerm = searchTermInput.value.trim();
-            if (!searchTerm) return;
-            if (!apiKey) {
-                showError("API Key fehlt.");
-                return;
-            }
-            if (typeof DinoPrompts === 'undefined') {
-                showError("Fehler: prompts.js nicht geladen.");
-                return;
-            }
-
-            activeModelType = selectedType;
-
-            setLoading(true);
-            errorBox.classList.add('hidden');
-            statusMessage.classList.remove('hidden');
-            previewSection.classList.add('hidden');
-            emptyState.classList.add('hidden');
-
-            try {
-                setStatus(`Sammle Fakten über ${searchTerm}`);
-                const dinoData = await fetchDinoFacts(searchTerm);
-                currentDinoData = dinoData;
-
-                // STATUS UPDATES
-                if (activeModelType === 'ultra') setStatus('Generiere ULTRA-Bild (Gemini 3, Beste Qualität)');
-                else if (activeModelType === 'pro') setStatus('Generiere PRO-Bild (Imagen 4, Gute Qualität)');
-                else setStatus('Generiere Entwurf (Flash, Schnell)');
-
-                const base64Image = await fetchDinoImage(dinoData, activeModelType);
-
-                setStatus('Erstelle finale Wissenskarte');
-                const finalImageUrl = await drawCanvas(dinoData, base64Image);
-
-                previewImage.src = finalImageUrl;
-                previewSection.classList.remove('hidden');
-
-                // BADGE UPDATE
-                qualityBadge.classList.remove('hidden');
-                if (activeModelType === 'ultra') {
-                    // Ultra = Gemini 3
-                    qualityBadge.innerText = "ULTRA (GEMINI 3)";
-                    qualityBadge.className = "absolute top-4 right-4 bg-pink-600/80 backdrop-blur text-white text-xs px-2 py-1 rounded border border-white/20";
-                } else if (activeModelType === 'pro') {
-                    // Pro = Imagen 4
-                    qualityBadge.innerText = "PRO (IMAGEN 4)";
-                    qualityBadge.className = "absolute top-4 right-4 bg-amber-600/80 backdrop-blur text-white text-xs px-2 py-1 rounded border border-white/20";
-                } else {
-                    qualityBadge.innerText = "ECO (FLASH)";
-                    qualityBadge.className = "absolute top-4 right-4 bg-slate-600/80 backdrop-blur text-white text-xs px-2 py-1 rounded border border-white/20";
-                }
-
-                isResultVisible = true;
-                logUsage(activeModelType);
-
-            } catch (err) {
-                console.error(err);
-                const msg = err.message || err.toString();
-                showError('Hoppla: ' + msg);
-                emptyState.classList.remove('hidden');
-            } finally {
-                setLoading(false);
-                statusMessage.classList.add('hidden');
-                updateButtonState();
-            }
-        }
-
-        function logUsage(type) {
-            fetch('index.php', {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/x-www-form-urlencoded'
-                },
-                body: 'action=log_success&type=' + type
-            })
-                .then(res => res.json())
-                .then(data => {
-                    if (data.status === 'logged') {
-                        statElems.eco.innerText = data.today_eco;
-                        statElems.pro.innerText = data.today_pro;
-                        statElems.ultra.innerText = data.today_ultra;
-
-                        statElems.totalEco.innerText = data.total_eco;
-                        statElems.totalPro.innerText = data.total_pro;
-                        statElems.totalUltra.innerText = data.total_ultra;
-
-                        currentCounts.eco = parseInt(data.today_eco);
-                        currentCounts.pro = parseInt(data.today_pro);
-                        currentCounts.ultra = parseInt(data.today_ultra);
-                    }
-                })
-                .catch(err => console.error("Logging failed", err));
-        }
-
-        function setLoading(isLoading) {
-            generateBtn.disabled = isLoading;
-            if (isLoading) {
-                btnIcon.classList.add('hidden');
-                btnLoader.classList.remove('hidden');
-                btnText.innerText = "Lade...";
-            } else {
-                btnLoader.classList.add('hidden');
-                btnIcon.classList.remove('hidden');
-            }
-        }
-
-        function setStatus(msg) {
-            statusMessage.innerText = msg;
-        }
-
-        function showError(msg) {
-            errorText.innerText = msg;
-            errorBox.classList.remove('hidden');
-        }
-
-        async function fetchDinoFacts(term) {
-            const factsPrompt = DinoPrompts.getFacts(term);
-            const response = await fetch(
-                `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash-preview-09-2025:generateContent?key=${apiKey}`, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json'
-                },
-                body: JSON.stringify({
-                    contents: [{
-                        parts: [{
-                            text: factsPrompt
-                        }]
-                    }]
-                })
-            }
-            );
-            if (!response.ok) {
-                const errText = await response.text();
-                if (response.status === 429 || errText.includes('RESOURCE_EXHAUSTED')) {
-                    throw new Error("API Quota Limit für Text (Facts) erreicht.");
-                }
-                throw new Error(`Fakten-Fehler (${response.status})`);
-            }
-            const result = await response.json();
-            const textContent = result.candidates?.[0]?.content?.parts?.[0]?.text;
-            if (!textContent) throw new Error("Keine Fakten erhalten");
-
-            // Auch hier: Robustes JSON Parsing verwenden
-            const firstBrace = textContent.indexOf('{');
-            const lastBrace = textContent.lastIndexOf('}');
-            if (firstBrace !== -1 && lastBrace !== -1) {
-                const jsonStr = textContent.substring(firstBrace, lastBrace + 1);
-                return JSON.parse(jsonStr);
-            }
-            // Fallback (falls die KI wirklich nur nacktes JSON schickt)
-            return JSON.parse(textContent);
-        }
-
-        async function fetchDinoImage(dinoData, type) {
-            const imagePrompt = DinoPrompts.getImage(dinoData);
-
-            let url = '';
-            let payload = {};
-            let isImagen = false;
-
-            if (type === 'ultra') {
-                url = `https://generativelanguage.googleapis.com/v1beta/models/gemini-3-pro-image-preview:generateContent?key=${apiKey}`;
-                payload = {
-                    contents: [{
-                        parts: [{
-                            text: imagePrompt
-                        }]
-                    }],
-                    generationConfig: {
-                        responseModalities: ["IMAGE"]
-                    }
-                };
-            } else if (type === 'pro') {
-                url = `https://generativelanguage.googleapis.com/v1beta/models/imagen-4.0-generate-001:predict?key=${apiKey}`;
-                payload = {
-                    instances: [{
-                        prompt: imagePrompt
-                    }],
-                    parameters: {
-                        sampleCount: 1
-                    }
-                };
-                isImagen = true;
-            } else {
-                url = `https://generativelanguage.googleapis.com/v1beta/models/gemini-2.5-flash-image:generateContent?key=${apiKey}`;
-                payload = {
-                    contents: [{
-                        parts: [{
-                            text: imagePrompt
-                        }]
-                    }],
-                    generationConfig: {
-                        responseModalities: ["IMAGE"]
-                    }
-                };
-            }
-
-            const response = await fetch(url, {
-                method: 'POST',
-                headers: {
-                    'Content-Type': 'application/json'
-                },
-                body: JSON.stringify(payload)
-            });
-
-            if (!response.ok) {
-                const errText = await response.text();
-                if (response.status === 429 || errText.includes('RESOURCE_EXHAUSTED')) {
-                    throw new Error("Google API Limit erreicht (Quota).");
-                }
-                throw new Error(`Bild-Fehler (${type}): ${errText}`);
-            }
-
-            const result = await response.json();
-
-            // DEBUGGING: Falls mal wieder was schief geht
-            console.log("API Response:", result);
-
-            if (isImagen) {
-                if (result.predictions && result.predictions.length > 0) {
-                    return result.predictions[0].bytesBase64Encoded;
-                }
-            } else {
-                // Gemini Logic checking
-                const candidate = result.candidates?.[0];
-                if (candidate) {
-                    // Check Safety / Finish Reason
-                    if (candidate.finishReason && candidate.finishReason !== "STOP") {
-                        console.warn("Safety Filter triggered:", candidate.safetyRatings);
-                        throw new Error(`Bild blockiert durch Filter (${candidate.finishReason}). Bitte versuche es noch einmal.`);
-                    }
-
-                    const parts = candidate.content?.parts;
-                    const imagePart = parts?.find(p => p.inlineData);
-                    if (imagePart && imagePart.inlineData) return imagePart.inlineData.data;
-                }
-            }
-
-            // Fallthrough logging
-            console.error("Keine Bilddaten gefunden. Rohe Antwort:", result);
-            throw new Error('Keine Bilddaten erhalten. Eventuell Sicherheitsfilter? (Details in Konsole)');
-        }
-
-        function drawCanvas(dinoData, base64Image) {
-            return new Promise((resolve) => {
-                const ctx = canvas.getContext('2d');
-                canvas.width = 1280;
-                canvas.height = 800;
-
-                const img = new Image();
-                img.crossOrigin = "anonymous";
-                img.onload = () => {
-                    // 1. Hintergrundbild
-                    const scale = Math.max(canvas.width / img.width, canvas.height / img.height);
-                    const x = (canvas.width / 2) - (img.width / 2) * scale;
-                    const y = (canvas.height / 2) - (img.height / 2) * scale;
-                    ctx.drawImage(img, x, y, img.width * scale, img.height * scale);
-
-                    // 2. Gradients (Nest Hub Safe)
-                    const topGradient = ctx.createLinearGradient(0, 0, 0, 350);
-                    topGradient.addColorStop(0, "rgba(0,0,0,0.85)");
-                    topGradient.addColorStop(1, "rgba(0,0,0,0)");
-                    ctx.fillStyle = topGradient;
-                    ctx.fillRect(0, 0, canvas.width, 350);
-
-                    const bottomGradient = ctx.createLinearGradient(0, canvas.height - 250, 0, canvas.height);
-                    bottomGradient.addColorStop(0, "rgba(0,0,0,0)");
-                    bottomGradient.addColorStop(1, "rgba(0,0,0,0.95)");
-                    ctx.fillStyle = bottomGradient;
-                    ctx.fillRect(0, canvas.height - 250, canvas.width, 250);
-
-                    // NEST HUB SAFE ZONE PADDING
-                    const padding = 80;
-
-                    // Vorab-Berechnung für Layout-Grenzen (Stats Box ist rechts)
-                    const boxWidth = 340;
-                    const boxX = canvas.width - boxWidth - padding;
-
-                    // 3. Name & Fun Fact (Oben Links)
-                    const nameY = 110;
-
-                    ctx.textAlign = 'left';
-                    ctx.shadowColor = "rgba(0, 0, 0, 0.9)";
-                    ctx.shadowBlur = 20;
-                    ctx.fillStyle = '#ffffff';
-
-                    // --- FIX: Dynamische Schriftgröße ---
-                    let fontSize = 70;
-                    ctx.font = `bold ${fontSize}px sans-serif`;
-
-                    // Maximaler Platz bis zur Stats-Box (mit 20px Puffer)
-                    const maxNameWidth = boxX - padding - 20;
-
-                    // Solange verkleinern, bis es passt oder Minimum erreicht ist
-                    while (ctx.measureText(dinoData.name).width > maxNameWidth && fontSize > 30) {
-                        fontSize--;
-                        ctx.font = `bold ${fontSize}px sans-serif`;
-                    }
-
-                    ctx.fillText(dinoData.name, padding, nameY);
-
-                    // Fun Fact (darunter) - Hier nehmen wir wieder eine feste Größe, aber wrappen früher
-                    const maxFactWidth = boxX - padding - 60;
-
-                    ctx.fillStyle = '#ffffff';
-                    ctx.font = 'italic 28px serif'; // Reset font
-                    wrapText(ctx, `"${dinoData.fun_fact}"`, padding + 4, nameY + 45, maxFactWidth, 35);
-                    ctx.shadowBlur = 0;
-
-                    // 4. STATS BOX (OBEN RECHTS)
-                    const boxHeight = 140;
-                    const boxY = 60; // Oben (Safe Zone)
-
-                    ctx.save();
-                    ctx.fillStyle = "rgba(255, 255, 255, 0.15)";
-                    ctx.strokeStyle = "rgba(255, 255, 255, 0.3)";
-                    ctx.lineWidth = 1;
-                    roundRect(ctx, boxX, boxY, boxWidth, boxHeight, 16);
-                    ctx.fill();
-                    ctx.stroke();
-                    ctx.restore();
-
-                    // Grid für 2 Zeilen, 2 Spalten
-                    const col1X = boxX + 25;
-                    const col2X = boxX + (boxWidth / 2) + 15;
-                    const row1Y = boxY + 45;
-                    const row2Y = boxY + 105;
-                    const colWidth = (boxWidth / 2) - 20;
-
-                    drawBoxStat(ctx, "Länge", `${dinoData.length} m`, col1X, row1Y, colWidth);
-                    drawBoxStat(ctx, "Höhe", `${dinoData.height} m`, col2X, row1Y, colWidth);
-                    drawBoxStat(ctx, "Gewicht", `${dinoData.weight} kg`, col1X, row2Y, colWidth);
-                    drawBoxStat(ctx, "Futter", dinoData.diet, col2X, row2Y, colWidth);
-
-
-                    // 5. ZEITACHSE
-                    const timelineY = canvas.height - 100; // Unten (Safe Zone)
-                    const timelineExtraPadding = 40;
-                    const axisWidth = canvas.width - (padding * 2) - (timelineExtraPadding * 2);
-                    const startX = padding + timelineExtraPadding;
-
-                    // Definiere Zeitfenster
-                    const START_TIME = 252;
-                    const END_TIME = 66;
-                    const TOTAL_YEARS = START_TIME - END_TIME;
-
-                    // Helper: Zeit zu X-Koordinate
-                    const getX = (mya) => {
-                        const offset = START_TIME - mya;
-                        return startX + (offset / TOTAL_YEARS) * axisWidth;
-                    };
-
-                    // Hintergrund-Achse
-                    ctx.beginPath();
-                    ctx.strokeStyle = "rgba(255, 255, 255, 0.3)";
-                    ctx.lineWidth = 2;
-                    ctx.moveTo(startX, timelineY);
-                    ctx.lineTo(startX + axisWidth, timelineY);
-                    ctx.stroke();
-
-                    // Epochen
-                    drawEpochLabel(ctx, "TRIAS", getX(226), timelineY);
-                    drawEpochSeparator(ctx, getX(201), timelineY);
-                    drawEpochLabel(ctx, "JURA", getX(173), timelineY);
-                    drawEpochSeparator(ctx, getX(145), timelineY);
-                    drawEpochLabel(ctx, "KREIDE", getX(105), timelineY);
-
-                    // ECHTER ZEITRAUM DES DINOS
-                    const myaStart = dinoData.mya_start || 100;
-                    const myaEnd = dinoData.mya_end || 90;
-
-                    if (myaEnd > START_TIME) {
-                        // Zu alt (Pfeil Links)
-                        ctx.fillStyle = '#f59e0b';
-                        ctx.textAlign = 'left';
-                        ctx.font = 'bold 14px sans-serif';
-                        ctx.beginPath();
-                        ctx.moveTo(startX, timelineY);
-                        ctx.lineTo(startX + 15, timelineY - 8);
-                        ctx.lineTo(startX + 15, timelineY + 8);
-                        ctx.fill();
-                        ctx.fillText("LEBTE DAVOR", startX + 25, timelineY + 5);
-                        ctx.fillStyle = '#f59e0b';
-                        ctx.textAlign = 'left';
-                        ctx.fillText(`${dinoData.years}`, startX, timelineY + 35);
-
-                    } else if (myaStart < END_TIME) {
-                        // Zu jung (Pfeil Rechts)
-                        ctx.fillStyle = '#f59e0b';
-                        ctx.textAlign = 'right';
-                        ctx.font = 'bold 14px sans-serif';
-                        const endX = startX + axisWidth;
-                        ctx.beginPath();
-                        ctx.moveTo(endX, timelineY);
-                        ctx.lineTo(endX - 15, timelineY - 8);
-                        ctx.lineTo(endX - 15, timelineY + 8);
-                        ctx.fill();
-                        ctx.fillText("LEBTE DANACH", endX - 25, timelineY + 5);
-                        ctx.fillStyle = '#f59e0b';
-                        ctx.textAlign = 'right';
-                        ctx.fillText(`${dinoData.years}`, endX, timelineY + 35);
-
-                    } else {
-                        // Standard Balken
-                        const clampedStart = Math.min(Math.max(myaStart, END_TIME), START_TIME);
-                        const clampedEnd = Math.min(Math.max(myaEnd, END_TIME), START_TIME);
-                        const dinoStartX = getX(clampedStart);
-                        const dinoEndX = getX(clampedEnd);
-                        let barWidth = Math.max(dinoEndX - dinoStartX, 4);
-
-                        ctx.shadowColor = "#f59e0b";
-                        ctx.shadowBlur = 15;
-                        ctx.fillStyle = "#f59e0b";
-                        ctx.beginPath();
-                        ctx.roundRect(dinoStartX, timelineY - 6, barWidth, 12, 4);
-                        ctx.fill();
-                        ctx.shadowBlur = 0;
-
-                        ctx.textAlign = 'center';
-                        ctx.font = 'bold 16px sans-serif';
-                        ctx.fillStyle = '#f59e0b';
-                        ctx.fillText(`${dinoData.years}`, dinoStartX + barWidth / 2, timelineY + 35);
-                    }
-
-                    // FANTASIE CHECK
-                    if (dinoData.is_fictional) {
-                        const badgeText = "FANTASIE - NICHT ECHT";
-                        ctx.font = 'bold 14px sans-serif';
-                        const badgeWidth = ctx.measureText(badgeText).width + 30;
-                        const badgeHeight = 28;
-                        const badgeX = (canvas.width - badgeWidth) / 2;
-                        const badgeY = timelineY - 60;
-
-                        ctx.fillStyle = '#ec4899';
-                        ctx.shadowColor = "rgba(0,0,0,0.5)";
-                        ctx.shadowBlur = 10;
-                        ctx.beginPath();
-                        ctx.roundRect(badgeX, badgeY, badgeWidth, badgeHeight, 14);
-                        ctx.fill();
-                        ctx.shadowBlur = 0;
-
-                        ctx.fillStyle = '#ffffff';
-                        ctx.textAlign = 'center';
-                        ctx.fillText(badgeText, canvas.width / 2, badgeY + 19);
-                    }
-
-                    resolve(canvas.toDataURL('image/png'));
-                };
-                img.src = `data:image/png;base64,${base64Image}`;
-            });
-        }
-
-        // --- Helper ---
-
-        function roundRect(ctx, x, y, width, height, radius) {
-            ctx.beginPath();
-            ctx.roundRect(x, y, width, height, radius);
-            ctx.closePath();
-        }
-
-        function drawBoxStat(ctx, label, value, x, y, maxWidth) {
-            ctx.textAlign = 'left';
-
-            // Label
-            ctx.fillStyle = 'rgba(255, 255, 255, 0.6)';
-            ctx.font = 'bold 11px sans-serif';
-            ctx.fillText(label, x, y - 10);
-
-            // Value
-            ctx.fillStyle = '#ffffff';
-            // Prüfen ob Text zu lang
-            let fontSize = 24;
-            ctx.font = `bold ${fontSize}px sans-serif`;
-            if (ctx.measureText(value).width > maxWidth) fontSize = 18;
-            ctx.font = `bold ${fontSize}px sans-serif`;
-
-            ctx.fillText(value, x, y + 15);
-        }
-
-        function drawEpochSeparator(ctx, x, y) {
-            ctx.beginPath();
-            ctx.strokeStyle = "rgba(255, 255, 255, 0.3)";
-            ctx.lineWidth = 1;
-            ctx.moveTo(x, y - 10);
-            ctx.lineTo(x, y + 10);
-            ctx.stroke();
-        }
-
-        function drawEpochLabel(ctx, text, x, y) {
-            ctx.textAlign = 'center';
-            ctx.fillStyle = "rgba(255, 255, 255, 0.4)";
-            ctx.font = 'bold 12px sans-serif';
-            ctx.fillText(text, x, y - 15);
-        }
-
-        function wrapText(ctx, text, x, y, maxWidth, lineHeight) {
-            const words = text.split(' ');
-            let line = '';
-            for (let n = 0; n < words.length; n++) {
-                const testLine = line + words[n] + ' ';
-                const metrics = ctx.measureText(testLine);
-                const testWidth = metrics.width;
-                if (testWidth > maxWidth && n > 0) {
-                    ctx.fillText(line, x, y);
-                    line = words[n] + ' ';
-                    y += lineHeight;
-                } else {
-                    line = testLine;
-                }
-            }
-            ctx.fillText(line, x, y);
-        }
-
-        // --- GOOGLE UPLOAD LOGIK ---
-        const uploadCloudBtn = document.getElementById('uploadCloudBtn');
-        const uploadText = document.getElementById('uploadText');
-        const uploadLoader = document.getElementById('uploadLoader');
-        const uploadIconWrapper = document.getElementById('uploadIconWrapper');
-
-        if (uploadCloudBtn) {
-            uploadCloudBtn.addEventListener('click', async () => {
-                if (!currentDinoData || !previewImage.src) return;
-
-                // UI auf "Laden" stellen
-                if (uploadCloudBtn) uploadCloudBtn.disabled = true;
-                if (uploadText) uploadText.innerText = "Sende...";
-
-                // Icon Wrapper ausblenden (nicht das <i> selbst, das ist jetzt weg!)
-                if (uploadIconWrapper) uploadIconWrapper.classList.add('hidden');
-                if (uploadLoader) uploadLoader.classList.remove('hidden');
-
-                try {
-                    const response = await fetch('upload_handler.php', {
-                        method: 'POST',
-                        headers: {
-                            'Content-Type': 'application/json'
-                        },
-                        body: JSON.stringify({
-                            image: previewImage.src, // Das ist der Base64 String
-                            name: currentDinoData.name,
-                            fun_fact: currentDinoData.fun_fact,
-                            years: currentDinoData.years
-                        })
-                    });
-
-                    // Falls PHP schon beim Parsen scheitert (z.B. Syntax Fehler)
-                    if (!response.ok) {
-                        throw new Error(`HTTP Fehler ${response.status}`);
-                    }
-
-                    const result = await response.json();
-
-                    // FIX 2: Check success OR if google details are present (toleranter für PHP Typo)
-                    if (result.success || (result.details && result.details.newMediaItemResults)) {
-                        if (uploadText) uploadText.innerText = "Gesendet!";
-                        if (uploadLoader) uploadLoader.classList.add('hidden');
-                        if (uploadIconWrapper) {
-                            uploadIconWrapper.classList.remove('hidden');
-
-                            // Icon zu Checkmark wechseln und neu rendern
-                            uploadIconWrapper.innerHTML = '<i data-lucide="check" width="20"></i>';
-                            lucide.createIcons();
-                        }
-
-                        // Nach 3 Sekunden zurücksetzen
-                        setTimeout(() => {
-                            if (uploadText) uploadText.innerText = "Auf Nest Hub";
-                            if (uploadCloudBtn) uploadCloudBtn.disabled = false;
-
-                            if (uploadIconWrapper) {
-                                // Icon zurück zu Cloud wechseln
-                                uploadIconWrapper.innerHTML = '<i data-lucide="cloud-upload" width="20"></i>';
-                                lucide.createIcons();
-                            }
-                        }, 3000);
-                    } else {
-                        // Detailliertes Logging für dich als Entwickler
-                        console.error("Google Upload Error Details:", result);
-
-                        // Versuch, eine verständliche Fehlermeldung zu bauen
-                        let detailMsg = "";
-                        if (result.details && result.details.error && result.details.error.message) {
-                            detailMsg = " (" + result.details.error.message + ")";
-                        } else if (result.details && typeof result.details === 'string') {
-                            detailMsg = " (" + result.details + ")";
-                        }
-
-                        throw new Error((result.error || "Unbekannter Fehler") + detailMsg);
-                    }
-
-                } catch (err) {
-                    console.error(err);
-                    alert("Upload Fehler: " + err.message);
-
-                    if (uploadText) uploadText.innerText = "Fehler";
-                    if (uploadCloudBtn) uploadCloudBtn.disabled = false;
-                    if (uploadLoader) uploadLoader.classList.add('hidden');
-                    if (uploadIconWrapper) uploadIconWrapper.classList.remove('hidden');
-                }
-            });
-        }
-    </script>
-</body>
-
-</html>
\ No newline at end of file
diff --git a/home/app/controllers/LoginController.php b/home/app/controllers/LoginController.php
index d6837fa..449d692 100644
--- a/home/app/controllers/LoginController.php
+++ b/home/app/controllers/LoginController.php
@@ -20,9 +20,11 @@ class LoginController extends Controller {
             $userModel = $this->model('User');
             $user = $userModel->authenticate($email, $password);
             if ($user) {
+                session_regenerate_id(true);
                 $_SESSION['user_email'] = $email;
                 $_SESSION['user_projects'] = $user['projects'] ?? [];
                 $_SESSION['is_admin'] = $user['is_admin'] ?? false;
+                $_SESSION['user_agent'] = $_SERVER['HTTP_USER_AGENT'] ?? '';
                 header('Location: ' . Config::get('BASE_URL', '/'));
             } else {
                 Flash::set('Access denied: Invalid credentials.');
diff --git a/home/app/init.php b/home/app/init.php
index a6c9648..281afb3 100644
--- a/home/app/init.php
+++ b/home/app/init.php
@@ -4,6 +4,7 @@ if (session_status() === PHP_SESSION_NONE) {
     session_set_cookie_params([
         'path' => '/',
         'httponly' => true,
+        'secure' => (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off'),
         'samesite' => 'Lax'
     ]);
     session_start();
diff --git a/home/core/Controller.php b/home/core/Controller.php
index 79f9fb3..8bb1db4 100644
--- a/home/core/Controller.php
+++ b/home/core/Controller.php
@@ -2,7 +2,7 @@
 
 class Controller {
     
-    public function model($model) {
+    protected function model($model) {
         $modelPath = __DIR__ . '/../app/models/' . $model . '.php';
         if (file_exists($modelPath)) {
             require_once $modelPath;
@@ -11,7 +11,7 @@ class Controller {
         throw new Exception("Model '{$model}' existiert nicht.");
     }
 
-    public function view($view, $data = []) {
+    protected function view($view, $data = []) {
         if (!empty($data)) {
             extract($data);
         }
@@ -25,20 +25,20 @@ class Controller {
         }
     }
 
-    public function json($data, $status = 200) {
+    protected function json($data, $status = 200) {
         http_response_code($status);
         header('Content-Type: application/json');
         echo json_encode($data);
         exit;
     }
 
-    public function xml($data) {
+    protected function xml($data) {
         header('Content-Type: application/xml; charset=utf-8');
         echo $data;
         exit;
     }
 
-    public function text($data) {
+    protected function text($data) {
         header('Content-Type: text/plain; charset=utf-8');
         echo $data;
         exit;
diff --git a/home/core/Router.php b/home/core/Router.php
index c6f0f67..5628397 100644
--- a/home/core/Router.php
+++ b/home/core/Router.php
@@ -16,8 +16,9 @@ class Router {
         $this->controller = new $this->controller;
         // Method Check
         if (isset($url[1])) {
-            if (method_exists($this->controller, $url[1])) {
-                $this->method = $url[1];
+            $candidateMethod = $url[1];
+            if (is_callable([$this->controller, $candidateMethod]) && strpos($candidateMethod, '_') !== 0) {
+                $this->method = $candidateMethod;
                 unset($url[1]);
             }
         }
diff --git a/home/core/Security.php b/home/core/Security.php
index b23dcb6..7c01785 100644
--- a/home/core/Security.php
+++ b/home/core/Security.php
@@ -9,7 +9,7 @@ class Security {
     }
     // CSRF Validation
     public static function checkCsrf($token) {
-        if (!isset($_SESSION['csrf_token']) || $token !== $_SESSION['csrf_token']) {
+        if (!isset($_SESSION['csrf_token']) || !hash_equals($_SESSION['csrf_token'], (string)$token)) {
             throw new Exception("Sicherheits-Token ungültig. Bitte lade die Seite neu.");
         }
         return true;
diff --git a/home/public/index.php b/home/public/index.php
index 43dec3d..8410a65 100644
--- a/home/public/index.php
+++ b/home/public/index.php
@@ -1,11 +1,12 @@
 <?php
-error_reporting(E_ALL);
-ini_set('display_errors', 1);
 if (file_exists(__DIR__ . '/../app/init.php')) {
     require_once __DIR__ . '/../app/init.php';
 } else {
     die("Kritischer Fehler: app/init.php wurde nicht gefunden.");
 }
+
+error_reporting(E_ALL);
+ini_set('display_errors', Config::get('APP_ENV') === 'development' ? 1 : 0);
 try {
     // Router
     $router = new Router();
diff --git a/philcore/app/init.php b/philcore/app/init.php
index ee4e744..11eae9a 100644
--- a/philcore/app/init.php
+++ b/philcore/app/init.php
@@ -1,6 +1,11 @@
 <?php
-// 1. Session starten
 if (session_status() === PHP_SESSION_NONE) {
+    session_set_cookie_params([
+        'path' => '/',
+        'httponly' => true,
+        'secure' => (!empty($_SERVER['HTTPS']) && $_SERVER['HTTPS'] !== 'off'),
+        'samesite' => 'Lax'
+    ]);
     session_start();
 }
 
diff --git a/philcore/core/Controller.php b/philcore/core/Controller.php
index f747ab4..c3e3a42 100644
--- a/philcore/core/Controller.php
+++ b/philcore/core/Controller.php
@@ -2,7 +2,7 @@
 class Controller {
     
     // Modell laden
-    public function model($model) {
+    protected function model($model) {
         $modelPath = __DIR__ . '/../app/models/' . $model . '.php';
         if (file_exists($modelPath)) {
             require_once $modelPath;
@@ -12,7 +12,7 @@ class Controller {
     }
 
     // View laden
-    public function view($view, $data = []) {
+    protected function view($view, $data = []) {
         if (!empty($data)) {
             extract($data);
         }
@@ -28,10 +28,22 @@ class Controller {
     }
 
     // JSON-Response für APIs und AJAX
-    public function json($data, $status = 200) {
+    protected function json($data, $status = 200) {
         http_response_code($status);
         header('Content-Type: application/json');
         echo json_encode($data);
         exit;
     }
+
+    protected function xml($data) {
+        header('Content-Type: application/xml; charset=utf-8');
+        echo $data;
+        exit;
+    }
+
+    protected function text($data) {
+        header('Content-Type: text/plain; charset=utf-8');
+        echo $data;
+        exit;
+    }
 }
\ No newline at end of file
diff --git a/philcore/core/Router.php b/philcore/core/Router.php
index 2050d09..da5f15c 100644
--- a/philcore/core/Router.php
+++ b/philcore/core/Router.php
@@ -21,8 +21,9 @@ class Router {
 
         // 2. Methode prüfen (z.B. /user/edit -> Methode edit())
         if (isset($url[1])) {
-            if (method_exists($this->controller, $url[1])) {
-                $this->method = $url[1];
+            $candidateMethod = $url[1];
+            if (is_callable([$this->controller, $candidateMethod]) && strpos($candidateMethod, '_') !== 0) {
+                $this->method = $candidateMethod;
                 unset($url[1]);
             }
         }
diff --git a/philcore/core/Security.php b/philcore/core/Security.php
index bdf8548..7c4bfef 100644
--- a/philcore/core/Security.php
+++ b/philcore/core/Security.php
@@ -10,7 +10,7 @@ class Security {
 
     // Token beim POST-Request prüfen
     public static function checkCsrf($token) {
-        if (!isset($_SESSION['csrf_token']) || $token !== $_SESSION['csrf_token']) {
+        if (!isset($_SESSION['csrf_token']) || !hash_equals($_SESSION['csrf_token'], (string)$token)) {
             throw new Exception("Sicherheits-Token ungültig. Bitte lade die Seite neu.");
         }
         return true;
diff --git a/plants/api.php b/plants/api.php
index 0b8bf8e..e1c73dd 100644
--- a/plants/api.php
+++ b/plants/api.php
@@ -1,5 +1,7 @@
 <?php
-// Version: 01.10.2025 14:15 (FIX created_at COLUMN)
+$current_project = 'plants';
+require_once __DIR__ . '/../auth.php';
+
 session_start();
 require_once 'db.php';
 require_once __DIR__ . '/vendor/autoload.php';
diff --git a/plants/auth_api.php b/plants/auth_api.php
index 7f8291f..db1993f 100644
--- a/plants/auth_api.php
+++ b/plants/auth_api.php
@@ -1,5 +1,6 @@
 <?php
-// Version: 24.09.2025 16:29
+$current_project = 'plants';
+require_once __DIR__ . '/../auth.php';
 
 require_once 'db.php'; // Stellt die $pdo-Verbindung her
 
diff --git a/plants/test.html b/plants/test.html
deleted file mode 100644
index 747e521..0000000
--- a/plants/test.html
+++ /dev/null
@@ -1,82 +0,0 @@
-<!DOCTYPE html>
-<html lang="de">
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Benachrichtigungs-Test</title>
-    <style>
-        body {
-            font-family: Arial, sans-serif;
-            display: flex;
-            justify-content: center;
-            align-items: center;
-            height: 100vh;
-            background-color: #f0f0f0;
-            margin: 0;
-            text-align: center;
-        }
-        .container {
-            background-color: white;
-            padding: 40px;
-            border-radius: 10px;
-            box-shadow: 0 4px 15px rgba(0, 0, 0, 0.1);
-        }
-        h1 {
-            color: #333;
-        }
-        p {
-            color: #666;
-            margin-bottom: 20px;
-        }
-        button {
-            padding: 12px 24px;
-            font-size: 16px;
-            border: none;
-            border-radius: 5px;
-            background-color: #007bff;
-            color: white;
-            cursor: pointer;
-            transition: background-color 0.3s ease;
-        }
-        button:hover {
-            background-color: #0056b3;
-        }
-    </style>
-</head>
-<body>
-    <div class="container">
-        <h1>Test für Browser-Benachrichtigungen</h1>
-        <p>Klicke auf den Knopf, um eine Test-Benachrichtigung auszulösen.</p>
-        <button id="testButton">Benachrichtigung senden</button>
-    </div>
-
-    <script>
-        document.getElementById('testButton').addEventListener('click', async () => {
-            // Schritt 1: Überprüfen und Erlaubnis anfordern
-            if (!('Notification' in window)) {
-                alert('Dieser Browser unterstützt keine Benachrichtigungen.');
-                return;
-            }
-
-            const permission = await Notification.requestPermission();
-            
-            if (permission === 'granted') {
-                // Schritt 2: Benachrichtigung erstellen
-                const notification = new Notification('Test-Benachrichtigung', {
-                    body: 'Herzlichen Glückwunsch, Benachrichtigungen funktionieren!',
-                    icon: 'https://placehold.co/64x64/007bff/FFFFFF?text=OK'
-                });
-
-                // Schritt 3: Event-Listener für den Klick hinzufügen
-                notification.addEventListener('click', () => {
-                    window.open('https://google.com', '_blank');
-                });
-
-                console.log('Test-Benachrichtigung gesendet.');
-            } else {
-                alert('Benachrichtigungsberechtigung wurde verweigert.');
-            }
-        });
-    </script>
-</body>
-</html>
diff --git a/plants/test_prompt.php b/plants/test_prompt.php
deleted file mode 100644
index 3d386a5..0000000
--- a/plants/test_prompt.php
+++ /dev/null
@@ -1,228 +0,0 @@
-<!-- Version: 24.09.2025 22:10 -->
-<!DOCTYPE html>
-<html lang="de">
-<head>
-    <meta charset="UTF-8">
-    <meta name="viewport" content="width=device-width, initial-scale=1.0">
-    <title>Prompt-Vergleich</title>
-    <style>
-        body {
-            font-family: sans-serif;
-            margin: 2em;
-            line-height: 1.6;
-            background-color: #f4f4f9;
-            color: #333;
-        }
-        .container {
-            display: flex;
-            gap: 20px;
-            margin-top: 20px;
-            flex-wrap: wrap;
-        }
-        .panel {
-            flex: 1;
-            min-width: 300px;
-            background-color: #fff;
-            padding: 20px;
-            border-radius: 8px;
-            box-shadow: 0 4px 8px rgba(0,0,0,0.1);
-        }
-        h1, h2 {
-            color: #5E8C61;
-        }
-        pre {
-            background-color: #eee;
-            padding: 15px;
-            border-radius: 6px;
-            white-space: pre-wrap;
-            word-wrap: break-word;
-            font-size: 0.9em;
-        }
-        .loading-bar {
-            width: 0;
-            height: 4px;
-            background-color: #5E8C61;
-            transition: width 0.4s ease;
-            margin-top: 10px;
-        }
-        .controls {
-            margin-bottom: 20px;
-        }
-        .controls input[type="file"] {
-            margin-right: 10px;
-        }
-        .controls button {
-            padding: 10px 15px;
-            background-color: #5E8C61;
-            color: white;
-            border: none;
-            border-radius: 5px;
-            cursor: pointer;
-        }
-    </style>
-</head>
-<body>
-
-    <h1>Prompt-Vergleich</h1>
-    <p>Lade ein Bild hoch und vergleiche die Ergebnisse mit dem alten und dem neuen Prompt.</p>
-    
-    <div class="controls">
-        <input type="file" id="imageInput" accept="image/*">
-        <button id="runTestBtn">Test starten</button>
-    </div>
-
-    <div id="loadingStatus" style="display: none;">
-        <p>Analysiere mit beiden Prompts...</p>
-        <div class="loading-bar"></div>
-    </div>
-    
-    <div class="container">
-        <div class="panel">
-            <h2>Alter Prompt</h2>
-            <div id="oldPromptResult"></div>
-        </div>
-        <div class="panel">
-            <h2>Finaler Profi-Prompt (V6)</h2>
-            <div id="newPromptResult"></div>
-        </div>
-    </div>
-
-    <script>
-        const imageInput = document.getElementById('imageInput');
-        const runTestBtn = document.getElementById('runTestBtn');
-        const loadingStatus = document.getElementById('loadingStatus');
-        const loadingBar = loadingStatus.querySelector('.loading-bar');
-        const oldPromptResult = document.getElementById('oldPromptResult');
-        const newPromptResult = document.getElementById('newPromptResult');
-
-        const PROXY_URL = 'api_proxy.php';
-
-        const oldPrompt = `
-            Du bist ein liebevoller Pflanzenexperte. Analysiere das Bild dieser Pflanze. Gib mir die folgenden Informationen als sauberen JSON-String zurück, ohne zusätzlichen Text oder Markdown.
-            - "name": Der gebräuchliche Name der Pflanze.
-            - "latin_name": Der botanische (lateinische) Name der Pflanze.
-            - "watering_interval_days": Das Gießintervall in Tagen (nur die Zahl).
-            - "fertilizing_interval_days": Das Düngeintervall in Tagen (nur die Zahl).
-            - "care_tips": Gib mir 3 kurze und liebevoll formulierte Pflegetipps.
-              WICHTIGE REGELN FÜR DIE FORMARTIERUNG DER TIPPS:
-              1. Jeder Tipp MUSS mit einem passenden Emoji und einem Titel beginnen (z.B. "☀️ Licht:").
-              2. Zwischen den einzelnen Tipps MUSS sich ein doppelter Zeilenumbruch (\\n\\n) befinden.
-            Falls du die Pflanze nicht sicher erkennen kannst, setze den Wert für "name" und "latin_name" auf "Unbekannt".
-        `;
-
-        const newPrompt = `
-            Du bist ein kritischer Botaniker. Deine Aufgabe ist es, die Pflanze auf dem Bild wissenschaftlich und so exakt wie möglich zu identifizieren.
-            Gib das Ergebnis als sauberen JSON-String zurück, ohne zusätzlichen Text oder Markdown.
-            
-            - "name": Der gebräuchlichste Name der Pflanze (nicht zwingend der deutsche).
-            - "latin_name": Der botanische (lateinische) Name der Pflanze.
-            - "plant_family": Die Pflanzenfamilie (z.B. "Araceae").
-            - "plant_genus": Die Pflanzengattung (z.B. "Monstera").
-            - "confidence_score": Bewerte deine Sicherheit bei der Identifizierung KRITISCH und ehrlich auf einer Skala von 0 (geraten) bis 100 (absolut sicher). Sei nicht übermäßig selbstbewusst. Ein Score von 95+ sollte nur bei perfekter Bildqualität und eindeutigen Merkmalen vergeben werden.
-            - "identification_notes": Gib eine sehr kurze Notiz, welche Merkmale zur Identifizierung geführt haben (z.B. "Herzförmige Blätter mit silbernen Flecken").
-            - "watering_interval_days": Das Gießintervall in Tagen (nur die Zahl).
-            - "fertilizing_interval_days": Das Düngeintervall in Tagen (nur die Zahl).
-            - "care_tips": Gib mir 3 kurze Pflegetipps.
-              WICHTIGE REGELN FÜR DIE TIPPS:
-              1. Formuliere die Tipps charmant aus der Ich-Perspektive der Pflanze (z.B. "☀️ Licht: Stell mich an einen hellen Ort, aber ohne direkte Mittagssonne.").
-              2. Jeder Tipp MUSS mit einem passenden Emoji und einem Titel beginnen (z.B. "☀️ Licht:").
-              3. Zwischen den Tipps MUSS sich ein doppelter Zeilenumbruch (\\n\\n) befinden.
-
-            WICHTIG: Falls dein confidence_score unter 75 liegt, setze "name", "latin_name", "plant_family", "plant_genus" auf "Unbekannt" und gib bei "identification_notes" den Grund für die Unsicherheit an (z.B. "Geringe Zuversicht aufgrund von schlechter Bildqualität.").
-        `;
-
-        runTestBtn.addEventListener('click', async () => {
-            const file = imageInput.files[0];
-            if (!file) {
-                alert('Bitte wähle zuerst ein Bild aus.');
-                return;
-            }
-
-            oldPromptResult.innerHTML = '';
-            newPromptResult.innerHTML = '';
-            runTestBtn.disabled = true;
-            loadingStatus.style.display = 'block';
-            loadingBar.style.width = '0%';
-
-            try {
-                const base64Image = await fileToBase64(file);
-
-                const analyzeWithProgress = async (prompt, resultElement) => {
-                    try {
-                        const result = await analyzeImage(base64Image, prompt);
-                        displayResult(resultElement, result);
-                    } catch (error) {
-                        displayResult(resultElement, { error: error.message });
-                    } finally {
-                         loadingBar.style.width = (parseInt(loadingBar.style.width) + 50) + '%';
-                    }
-                };
-                
-                await Promise.all([
-                    analyzeWithProgress(oldPrompt, oldPromptResult),
-                    analyzeWithProgress(newPrompt, newPromptResult)
-                ]);
-
-            } catch (error) {
-                console.error('Test failed:', error);
-                alert('Fehler beim Test: ' + error.message);
-            } finally {
-                runTestBtn.disabled = false;
-                loadingStatus.style.display = 'none';
-                loadingBar.style.width = '0%';
-            }
-        });
-
-        function fileToBase64(file) {
-            return new Promise((resolve, reject) => {
-                const reader = new FileReader();
-                reader.readAsDataURL(file);
-                reader.onload = () => resolve(reader.result.split(',')[1]);
-                reader.onerror = error => reject(error);
-            });
-        }
-
-        async function analyzeImage(base64Image, prompt) {
-            const requestPayload = {
-                "contents": [
-                    {
-                        "parts": [
-                            { "text": prompt },
-                            { "inline_data": { "mime_type": "image/jpeg", "data": base64Image } }
-                        ]
-                    }
-                ]
-            };
-
-            const response = await fetch(PROXY_URL, {
-                method: 'POST',
-                headers: { 'Content-Type': 'application/json' },
-                body: JSON.stringify({ payload: requestPayload })
-            });
-
-            if (!response.ok) {
-                const errorBody = await response.text();
-                throw new Error(`API error! status: ${response.status}, body: ${errorBody}`);
-            }
-            return response.json();
-        }
-
-        function displayResult(element, result) {
-            if (result.error) {
-                 element.innerHTML = `<p style="color:red;">API Fehler:<br><pre>${result.error}</pre></p>`;
-                 return;
-            }
-            try {
-                const textResponse = result.candidates[0].content.parts[0].text;
-                const jsonString = textResponse.replace(/```json|```/g, '').trim();
-                const plantData = JSON.parse(jsonString);
-                
-                element.innerHTML = `<pre>${JSON.stringify(plantData, null, 2)}</pre>`;
-            } catch (e) {
-                element.innerHTML = `<p style="color:red;">Fehler beim Parsen der Antwort. Rohe Antwort:<br><pre>${JSON.stringify(result, null, 2)}</pre></p>`;
-            }
-        }
-    </script>
-</body>
-</html>
-
diff --git a/test/index.html b/test/index.html
deleted file mode 100644
index 090d6b2..0000000
--- a/test/index.html
+++ /dev/null
@@ -1,22 +0,0 @@
-<?php
-// DATEI: ./test/index.php
-
-// 1. Name des Projekts definieren (muss exakt wie im Admin-Dashboard heißen)
-$current_project = 'test';
-
-// 2. Zentralen Türsteher aus dem Root einbinden
-require_once __DIR__ . '/../auth.php';
-
-// Ab hier ist die Seite sicher! 
-?>
-<!DOCTYPE html>
-<html lang="de">
-<head>
-    <meta charset="UTF-8">
-    <title>Test Projekt</title>
-</head>
-<body>
-    <h1>Zugriff gewährt!</h1>
-    <p>Willkommen im Test-Projekt, <?= htmlspecialchars($_SESSION['user_email']) ?>.</p>
-</body>
-</html>
\ No newline at end of file