fix(csrf): non-www-Canonical + trustedOrigins für www-Fallback

SvelteKits CSRF-Check blockte multipart-POSTs (/api/mitmachen) mit 403:
ORIGIN env stand auf www, Caddy redirected aber www -> non-www — jeder
Besucher war auf non-www, Origin-Header passte nie. Env-Flip auf non-www
(secrets), hier: www als trustedOrigin-Fallback + Kit-Bump auf ^2.65
(trustedOrigins gibt es ab 2.23).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

package-lock.json

@@ -28,7 +28,7 @@
       "devDependencies": {
         "@iconify-json/mdi": "^1.2.3",
         "@sveltejs/adapter-node": "^5.2.12",
-        "@sveltejs/kit": "^2.21.4",
+        "@sveltejs/kit": "^2.65.0",
         "@sveltejs/vite-plugin-svelte": "^5.0.3",
         "@tailwindcss/vite": "^4.1.18",
         "@types/node": "^22.10.0",
@@ -1952,18 +1952,18 @@
       }
     },
     "node_modules/@sveltejs/kit": {
-      "version": "2.55.0",
+      "version": "2.65.0",
-      "resolved": "https://registry.npmjs.org/@sveltejs/kit/-/kit-2.55.0.tgz",
+      "resolved": "https://registry.npmjs.org/@sveltejs/kit/-/kit-2.65.0.tgz",
-      "integrity": "sha512-MdFRjevVxmAknf2NbaUkDF16jSIzXMWd4Nfah0Qp8TtQVoSp3bV4jKt8mX7z7qTUTWvgSaxtR0EG5WJf53gcuA==",
+      "integrity": "sha512-nUWJ4dSKNo8mIOh+HTL+XyRj8FX9Dyb1ayBxj4q9+WrTJfn4jfTt21p3WUFTnnmdnt9xAXpBKLQ+H9y41x0X7Q==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
         "@standard-schema/spec": "^1.0.0",
-        "@sveltejs/acorn-typescript": "^1.0.5",
+        "@sveltejs/acorn-typescript": "^1.0.9",
         "@types/cookie": "^0.6.0",
-        "acorn": "^8.14.1",
+        "acorn": "^8.16.0",
         "cookie": "^0.6.0",
-        "devalue": "^5.6.4",
+        "devalue": "^5.8.1",
         "esm-env": "^1.2.2",
         "kleur": "^4.1.5",
         "magic-string": "^0.30.5",
@@ -1981,7 +1981,7 @@
         "@opentelemetry/api": "^1.0.0",
         "@sveltejs/vite-plugin-svelte": "^3.0.0 || ^4.0.0-next.1 || ^5.0.0 || ^6.0.0-next.0 || ^7.0.0",
         "svelte": "^4.0.0 || ^5.0.0-next.0",
-        "typescript": "^5.3.3",
+        "typescript": "^5.3.3 || ^6.0.0",
         "vite": "^5.0.3 || ^6.0.0 || ^7.0.0-beta.0 || ^8.0.0"
       },
       "peerDependenciesMeta": {
@@ -3167,9 +3167,9 @@
       }
     },
     "node_modules/devalue": {
-      "version": "5.6.4",
+      "version": "5.8.1",
-      "resolved": "https://registry.npmjs.org/devalue/-/devalue-5.6.4.tgz",
+      "resolved": "https://registry.npmjs.org/devalue/-/devalue-5.8.1.tgz",
-      "integrity": "sha512-Gp6rDldRsFh/7XuouDbxMH3Mx8GMCcgzIb1pDTvNyn8pZGQ22u+Wa+lGV9dQCltFQ7uVw0MhRyb8XDskNFOReA==",
+      "integrity": "sha512-4CXDYRBGqN+57wVJkuXBYmpAVUSg3L6JAQa/DFqm238G73E1wuyc/JhGQJzN7vUf/CMphYau2zXbfWzDR5aTEw==",
       "license": "MIT"
     },
     "node_modules/dijkstrajs": {

package.json

@@ -22,7 +22,7 @@
   "devDependencies": {
     "@iconify-json/mdi": "^1.2.3",
     "@sveltejs/adapter-node": "^5.2.12",
-    "@sveltejs/kit": "^2.21.4",
+    "@sveltejs/kit": "^2.65.0",
     "@sveltejs/vite-plugin-svelte": "^5.0.3",
     "@tailwindcss/vite": "^4.1.18",
     "@types/node": "^22.10.0",

svelte.config.js

@@ -5,6 +5,14 @@ const config = {
   preprocess: vitePreprocess(),
   kit: {
     adapter: adapter(),
+    csrf: {
+      // SvelteKits Origin-Check vergleicht gegen env ORIGIN (non-www,
+      // kanonisch — Caddy redirected www → non-www). www als Fallback
+      // vertrauen, falls ein Client den Redirect umgeht; multipart-POSTs
+      // (Mitmachen-Formular) liefen sonst in "Cross-site POST form
+      // submissions are forbidden". Die API-Routen prüfen Origin zusätzlich.
+      trustedOrigins: ['https://www.windwiderstand.de'],
+    },
   },
 };