Add Turnstile protection and harden export workflow

download.php

@@ -0,0 +1,47 @@
+<?php
+declare(strict_types=1);
+
+require_once __DIR__ . '/app.php';
+app_send_security_headers();
+header('Cache-Control: private, no-store, max-age=0');
+header('Pragma: no-cache');
+header('X-Robots-Tag: noindex, nofollow, noarchive');
+
+if (($_SERVER['REQUEST_METHOD'] ?? '') !== 'GET') {
+    header('Allow: GET');
+    http_response_code(405);
+    exit('Methode nicht erlaubt.');
+}
+
+$tokenValue = $_GET['token'] ?? '';
+$token = is_scalar($tokenValue) ? strtolower(trim((string)$tokenValue)) : '';
+if (!preg_match('/^[a-f0-9]{32}$/', $token)) {
+    http_response_code(404);
+    exit('Download nicht gefunden.');
+}
+
+$filename = app_download_path($token);
+$retentionSeconds = app_env_int('DOWNLOAD_RETENTION_HOURS', 48, 1, 720) * 3600;
+$modified = is_file($filename) ? filemtime($filename) : false;
+if ($modified === false || $modified < time() - $retentionSeconds) {
+    if (is_file($filename)) {
+        @unlink($filename);
+    }
+    http_response_code(404);
+    exit('Der Download ist nicht vorhanden oder bereits abgelaufen.');
+}
+
+$size = filesize($filename);
+header('Content-Type: text/csv; charset=UTF-8');
+header('Content-Disposition: attachment; filename="zefix-export.csv"');
+if ($size !== false) {
+    header('Content-Length: ' . $size);
+}
+
+$handle = fopen($filename, 'rb');
+if ($handle === false) {
+    http_response_code(500);
+    exit('Der Download konnte nicht geöffnet werden.');
+}
+fpassthru($handle);
+fclose($handle);