- Add Cookie Consent component (TTDSG-compliant, essential + analytics cookies)
- Add GDPR Data Export API (DSGVO Art. 20 - data portability)
- Add Account Deletion API (DSGVO Art. 17 - right to erasure, 30-day grace period)
- Add Datenschutz (Privacy) tab in Settings with:
- Privacy policy (data collected, purpose, retention, third-party sharing)
- User rights (6 DSGVO rights with descriptions)
- Data export button (download all personal data as JSON)
- Account deletion with confirmation dialog and grace period
- Jugendschutz (youth protection) notices
- DPA/AVV section for admin (Auftragsverarbeitungsvertrag)
- Add Jugendschutz notice in student login (parental consent for under 16)
- Add 65+ i18n keys for DE and EN (DSGVO, privacy, Jugendschutz, DPA)
- All German law terms accurate (DSGVO, Jugendschutzgesetz, TTDSG, AVV)
- Fix auth session persistence: set cookie on both cookies() and NextResponse
- Fix isSecureRequest: check x-forwarded-proto for HTTPS proxy support
- Fix excessive GET /api/auth polling: add useRef guard to prevent duplicate checks
- Increase rate limits: auth POST 30/min, auth GET 120/min
- Fix script tag warning: use ref-based textContent instead of dangerouslySetInnerHTML in chart.tsx
- Fix sanitizeHtml: improve regex patterns for script tag removal
- Fix module factory error: disable SW registration in dev, skip /_next/ caching in sw.js
- Bump SW cache version v2→v3 to force cache invalidation
- Better error handling in auth route with specific error messages