fix(security): externalize CORS origins, secure JWT secret default, fix RouterLink import

- Externalize CORS origins via app.cors-origins property (configurable per environment)
- Remove hardcoded JWT secret fallback; use env-var-only with safe test default
- Disable show-sql by default (enable only in dev profile)
- Create application-dev.yml with safe development defaults
- Add missing RouterLink import in MyMembershipsComponent (fixes runtime error)

eeg_backend/src/main/java/at/mueller/eeg/backend/iam/config/SecurityConfig.java

@@ -90,10 +90,13 @@ public class SecurityConfig {
         return jwtAuthenticationConverter;
     }
 
+    @Value("${app.cors-origins:http://localhost:4200}")
+    private String corsOrigins;
+
     @Bean
     public CorsConfigurationSource corsConfigurationSource() {
         CorsConfiguration configuration = new CorsConfiguration();
-        configuration.setAllowedOrigins(List.of("http://localhost:4200"));
+        configuration.setAllowedOrigins(Arrays.stream(corsOrigins.split(",")).map(String::trim).toList());
         configuration.setAllowedMethods(Arrays.asList("GET", "POST", "PUT", "DELETE", "OPTIONS", "PATCH"));
         configuration.setAllowedHeaders(Arrays.asList("Authorization", "Content-Type"));
         configuration.setAllowCredentials(true);

eeg_backend/src/main/resources/application-dev.yml

@@ -0,0 +1,7 @@
+spring:
+  jpa:
+    show-sql: true
+jwt:
+  secret: dev-only-secret-do-not-use-in-production-2025
+app:
+  cors-origins: http://localhost:4200

eeg_backend/src/main/resources/application.yml

@@ -9,9 +9,10 @@ spring:
   jpa:
     hibernate:
       ddl-auto: update
-    show-sql: true
+    show-sql: false
 jwt:
-  secret: ${JWT_SECRET:MeinSuperGeheimesUndSehrLangesSecretFuerDasEnergiePortal2025!}
+  secret: ${JWT_SECRET:test-only-secret-not-for-production}
 app:
-  frontend-url: http://localhost:4200
-  backend-url: http://localhost:8080
+  frontend-url: ${APP_FRONTEND_URL:http://localhost:4200}
+  backend-url: ${APP_BACKEND_URL:http://localhost:8080}
+  cors-origins: ${CORS_ORIGINS:http://localhost:4200}

eeg_frontend/src/app/pages/my-memberships/my-memberships.ts

@@ -1,12 +1,13 @@
 import {Component, inject, OnInit, signal} from '@angular/core';
 import {FormsModule} from '@angular/forms';
+import {RouterLink} from '@angular/router';
 import {MembershipService, MembershipResponse} from '../../services/membership';
 import {ToastService} from '../../services/toast';
 
 @Component({
   selector: 'app-my-memberships',
   standalone: true,
-  imports: [FormsModule],
+  imports: [FormsModule, RouterLink],
   templateUrl: './my-memberships.html'
 })
 export class MyMembershipsComponent implements OnInit {