feat(deploy): add umami tracking, fix CSP, and lock JSON writes

privat/CV/andreknie.de/server/routes/resource-download.js

@@ -2,11 +2,13 @@ import { Router } from 'express'
 import { readFileSync, writeFileSync, existsSync } from 'fs'
 import { join, dirname } from 'path'
 import { fileURLToPath } from 'url'
+import { Mutex } from 'async-mutex'
 import { resourceLimiter } from '../middleware/rateLimiter.js'
 import { antiSpam } from '../middleware/antiSpam.js'
 
 const __dirname = dirname(fileURLToPath(import.meta.url))
 const LEADS_FILE = join(__dirname, '..', 'data', 'leads.json')
+const leadsMutex = new Mutex()
 
 // Only alphanumeric + hyphen resource IDs are allowed. This prevents path
 // traversal (e.g. "../../etc/passwd") when building the download URL.
@@ -24,7 +26,7 @@ function saveLeads(leads) {
 
 const router = Router()
 
-router.post('/', resourceLimiter, antiSpam, (req, res) => {
+router.post('/', resourceLimiter, antiSpam, async (req, res) => {
   const { name, email, company, resource_id } = req.body
   const errors = {}
   if (!name || name.trim().length === 0) errors.name = 'Name ist erforderlich.'
@@ -38,15 +40,17 @@ router.post('/', resourceLimiter, antiSpam, (req, res) => {
     return res.status(400).json({ errors })
   }
 
-  const leads = loadLeads()
-  leads.push({
-    name,
-    email,
-    company,
-    resource_id,
-    timestamp: new Date().toISOString(),
+  await leadsMutex.runExclusive(async () => {
+    const leads = loadLeads()
+    leads.push({
+      name,
+      email,
+      company,
+      resource_id,
+      timestamp: new Date().toISOString(),
+    })
+    saveLeads(leads)
   })
-  saveLeads(leads)
 
   // Return download URL (resource files are in public/resources/)
   res.json({ ok: true, download_url: `/resources/${resource_id}.pdf` })