feat(deploy): add umami tracking, fix CSP, and lock JSON writes

privat/CV/andreknie.de/server/routes/speaker-cv.js

@@ -2,6 +2,7 @@ import { Router } from 'express'
 import { readFileSync, writeFileSync, existsSync } from 'fs'
 import { join, dirname } from 'path'
 import { fileURLToPath } from 'url'
+import { Mutex } from 'async-mutex'
 import { resourceLimiter } from '../middleware/rateLimiter.js'
 import { antiSpam } from '../middleware/antiSpam.js'
 import { sendSpeakerCv } from '../services/mailer.js'
@@ -9,6 +10,7 @@ import { sendSpeakerCv } from '../services/mailer.js'
 const __dirname = dirname(fileURLToPath(import.meta.url))
 const LEADS_FILE = join(__dirname, '..', 'data', 'speaker-cv-leads.json')
 const PDF_PATH = join(__dirname, '..', '..', 'public', 'resources', 'speaker-cv-andre-knie.pdf')
+const leadsMutex = new Mutex()
 
 function loadLeads() {
   if (!existsSync(LEADS_FILE)) return []
@@ -36,9 +38,11 @@ router.post('/', resourceLimiter, antiSpam, async (req, res) => {
   }
 
   const lead = { name, email, message, timestamp: new Date().toISOString() }
-  const leads = loadLeads()
-  leads.push(lead)
-  saveLeads(leads)
+  await leadsMutex.runExclusive(async () => {
+    const leads = loadLeads()
+    leads.push(lead)
+    saveLeads(leads)
+  })
 
   await sendSpeakerCv(email, lead, PDF_PATH)