Initial commit: OMSORG website + Mitarbeiter-App

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

.htaccess

@@ -0,0 +1,28 @@
+# HTTPS erzwingen
+RewriteEngine On
+RewriteCond %{HTTPS} !=on
+RewriteRule ^ https://%{HTTP_HOST}%{REQUEST_URI} [R=301,L]
+
+# Verzeichnis-Listing verbieten
+Options -Indexes
+
+# Security-Header
+<IfModule mod_headers.c>
+    Header always set X-Frame-Options "SAMEORIGIN"
+    Header always set X-Content-Type-Options "nosniff"
+    Header always set Referrer-Policy "strict-origin-when-cross-origin"
+    Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains" env=HTTPS
+    Header always set Permissions-Policy "geolocation=(), microphone=(), camera=()"
+</IfModule>
+
+# Direkte Aufrufe sensibler Dateien blockieren
+<FilesMatch "^(config\.php|config\.secret\.php|config\.secret\.example\.php|users\.json|README\.txt|\.env)$">
+    Require all denied
+</FilesMatch>
+
+# PHP-Konfiguration für Session-Sicherheit
+<IfModule mod_php.c>
+    php_flag session.cookie_httponly On
+    php_flag session.cookie_secure On
+    php_value session.cookie_samesite "Lax"
+</IfModule>