some improvements from claude

server.js

@@ -5,6 +5,9 @@ require('dotenv').config(); // Load environment variables first
 const express = require('express');
 const path = require('path');
 const cookieParser = require('cookie-parser');
+const helmet = require('helmet'); // Add security headers
+const compression = require('compression'); // Add compression
+const morgan = require('morgan'); // Add request logging
 
 // Import route handlers
 const authRoutes = require('./routes/authRoutes');
@@ -17,6 +20,23 @@ const PORT = process.env.PORT || 3000;
 
 // --- Middleware ---
 
+// Add security headers
+app.use(helmet({
+  contentSecurityPolicy: {
+    directives: {
+      defaultSrc: ["'self'"],
+      scriptSrc: ["'self'"],
+      styleSrc: ["'self'", "'unsafe-inline'"],
+    },
+  }
+}));
+
+// Add compression to improve performance
+app.use(compression());
+
+// Add request logging
+app.use(morgan('dev'));
+
 // Parse JSON request bodies
 app.use(express.json());
 // Parse URL-encoded request bodies
@@ -28,7 +48,6 @@ app.use(cookieParser());
 // Files in 'public' will be accessible directly, e.g., /style.css, /script.js
 app.use(express.static(path.join(__dirname, 'public')));
 
-
 // --- Routes ---
 
 // API routes
@@ -40,28 +59,40 @@ app.use('/api/todos', todoRoutes); // Todo CRUD routes (protected by auth middle
 // to avoid conflicts with static files or API routes.
 app.use('/', viewRoutes);
 
-
 // --- Global Error Handler (Basic Example) ---
-// Catches errors passed via next(error) or uncaught errors in route handlers
-// ***** GEÄNDERT: Sendet jetzt JSON zurück *****
 app.use((err, req, res, next) => {
-  console.error("Global Error Handler:", err.stack || err); // Log the full error stack
+  console.error("Global Error Handler:", err.stack || err);
 
-  // Check if the response headers have already been sent
   if (res.headersSent) {
-    return next(err); // Delegate to default Express error handler if headers are sent
+    return next(err);
   }
 
   // Send a generic JSON error response
   res.status(500).json({
-      message: 'Ein unerwarteter Serverfehler ist aufgetreten.',
-      // Optional: Nur im Entwicklungsmodus detailliertere Fehler senden
-      // error: process.env.NODE_ENV === 'development' ? err.message : undefined
+    message: 'Ein unerwarteter Serverfehler ist aufgetreten.',
+    error: process.env.NODE_ENV === 'development' ? err.message : undefined
   });
 });
 
 // --- Start Server ---
-app.listen(PORT, () => {
+const server = app.listen(PORT, () => {
   console.log(`Server läuft auf http://localhost:${PORT}`);
-  // Database connection message is handled in db.js
 });
+
+// Handle graceful shutdown
+process.on('SIGTERM', gracefulShutdown);
+process.on('SIGINT', gracefulShutdown);
+
+function gracefulShutdown() {
+  console.log('Gracefully shutting down...');
+  server.close(() => {
+    console.log('Server closed');
+    process.exit(0);
+  });
+  
+  // Force close after 10s if server hasn't closed gracefully
+  setTimeout(() => {
+    console.error('Server close timeout, forcing exit');
+    process.exit(1);
+  }, 10000);
+}