Add PayPal integration and band image upload features

- Implemented complete PayPal payment integration with checkout flow
- Added payments table to database for transaction tracking
- Created image upload functionality for band profiles
- Added gallery management in band profiles
- Updated booking flow to support PayPal payments
- Added payment status display in user profiles
- Included comprehensive documentation for new features

New files:
- upload-handler.php: REST API for image uploads
- paypal-checkout.php: PayPal checkout page
- paypal-process.php: Payment processing backend
- PAYPAL_UPLOAD_FEATURES.md: Complete documentation
- storage/uploads/bands/: Upload directory

Modified files:
- database.sql: Added payments table
- profil.php: Added gallery and payment tracking
- anfrage.php: Integrated PayPal payment option

.vscode/sftp.json

@@ -0,0 +1,12 @@
+{
+    "name": "Mein Webserver",
+    "host": "192.168.178.88",
+    "protocol": "sftp",
+    "port": 22,
+    "username": "root",
+    "password": "934290",
+    "remotePath": "/var/www/html/",
+    "uploadOnSave": true,
+    "useTempFile": false,
+    "openSsh": false
+}

PAYPAL_UPLOAD_FEATURES.md

@@ -0,0 +1,180 @@
+# Neue Features: PayPal-Integration & Bild-Upload
+
+Dieses Dokument beschreibt die neu hinzugefügten Features für die GetYourBand-Plattform.
+
+## 🖼️ Bild-Upload für Bands
+
+### Features
+- **Upload-Funktionalität**: Bands können eigene Bilder hochladen
+- **Galerie-Verwaltung**: Anzeige und Verwaltung aller hochgeladenen Bilder
+- **Löschen**: Bilder können jederzeit gelöscht werden
+- **Validierung**:
+  - Erlaubte Formate: JPG, PNG, GIF, WEBP
+  - Maximale Dateigröße: 5MB
+  - Automatische Dateinamens-Generierung
+
+### Technische Details
+- **Upload-Verzeichnis**: `/storage/uploads/bands/`
+- **Handler**: `upload-handler.php`
+- **Frontend**: AJAX-basierter Upload mit Fetch API
+- **Dateinamensschema**: `band_{band_id}_{unique_id}.{extension}`
+
+### Verwendung
+1. Als Band-User einloggen
+2. Zum Profil navigieren (`profil.php`)
+3. Sektion "Band-Galerie" finden
+4. Auf "+ Bild hochladen" klicken
+5. Bild auswählen (wird automatisch hochgeladen)
+
+### Sicherheit
+- Nur authentifizierte Band-User können uploaden
+- Strenge Dateitypprüfung (MIME-Type + Extension)
+- Größenlimit verhindert DoS
+- Sichere Dateinamen ohne User-Input
+
+---
+
+## 💳 PayPal-Integration
+
+### Features
+- **Zahlungsabwicklung**: Kunden können Buchungen direkt mit PayPal bezahlen
+- **Service Fee**: Konfigurierbare Servicegebühr (in Admin-Settings)
+- **Zahlungs-Tracking**: Alle Zahlungen werden in der Datenbank gespeichert
+- **Status-Updates**: Anfragen werden automatisch auf "bestätigt" gesetzt
+- **Email-Benachrichtigungen**: Kunde und Band erhalten Bestätigungen
+
+### Komponenten
+
+#### 1. Datenbank
+Neue Tabelle `payments`:
+```sql
+CREATE TABLE payments (
+    id INTEGER PRIMARY KEY,
+    request_id INTEGER NOT NULL,
+    amount REAL NOT NULL,
+    service_fee REAL NOT NULL,
+    total_amount REAL NOT NULL,
+    paypal_order_id TEXT,
+    paypal_payer_id TEXT,
+    status TEXT DEFAULT 'pending',
+    created_at TEXT,
+    completed_at TEXT
+);
+```
+
+#### 2. Checkout-Seite
+**Datei**: `paypal-checkout.php`
+- Zeigt Buchungsdetails und Zahlungsübersicht
+- Integriert PayPal JavaScript SDK
+- Berechnet Gesamtbetrag (Band-Gage + Service Fee)
+
+#### 3. Payment Processing
+**Datei**: `paypal-process.php`
+- Speichert erfolgreiche Zahlungen
+- Aktualisiert Request-Status
+- Sendet Bestätigungs-Emails
+
+#### 4. Integration in Buchungsflow
+**Änderungen in `anfrage.php`**:
+- Nach erfolgreicher Anfrage wird PayPal-Button angezeigt (wenn aktiviert)
+- Direkter Link zum Checkout
+
+**Änderungen in `profil.php`**:
+- Zahlungsstatus für jede Anfrage angezeigt
+- "Jetzt bezahlen"-Button für ausstehende Zahlungen
+
+### PayPal-Konfiguration
+
+#### Admin-Einstellungen
+Im Admin-Panel (`admin/settings.php`):
+- `paypal_enabled`: 0/1 (aktiviert/deaktiviert)
+- `service_fee`: Prozentsatz (z.B. 8 für 8%)
+
+#### PayPal API Credentials
+In `paypal-checkout.php` Zeile 80:
+```javascript
+<script src="https://www.paypal.com/sdk/js?client-id=YOUR_PAYPAL_CLIENT_ID&currency=CHF"></script>
+```
+
+**Wichtig**: `YOUR_PAYPAL_CLIENT_ID` durch echte Client-ID ersetzen!
+
+#### PayPal Developer Setup
+1. Gehen Sie zu https://developer.paypal.com
+2. Erstellen Sie eine App in "My Apps & Credentials"
+3. Kopieren Sie die Client-ID
+4. Für Produktion: Aktivieren Sie Live-Modus und verwenden Sie Live-Credentials
+
+### Zahlungsablauf
+
+1. **Kunde erstellt Anfrage** → Request wird in DB gespeichert
+2. **PayPal-Link erscheint** → Kunde klickt auf "Mit PayPal bezahlen"
+3. **Checkout-Seite** → Übersicht und PayPal-Button
+4. **PayPal-Zahlung** → Kunde loggt sich in PayPal ein und zahlt
+5. **Payment Processing** → Zahlung wird in DB gespeichert
+6. **Status-Update** → Request → "bestätigt", Emails versandt
+7. **Rückkehr zum Profil** → Erfolgsmeldung
+
+### Testmodus
+
+Die aktuelle Implementation läuft im **Sandbox-Modus**:
+- Verwenden Sie PayPal Sandbox-Accounts zum Testen
+- Keine echten Transaktionen werden durchgeführt
+- Für Produktion: Client-ID auf Live-Credentials umstellen
+
+### Sicherheit
+- Zahlung nur für eigene Requests möglich
+- Doppelzahlungen werden verhindert
+- Transaktions-IDs werden gespeichert
+- Server-seitige Validierung aller Zahlungsdaten
+
+---
+
+## 📂 Neue Dateien
+
+| Datei | Beschreibung |
+|-------|--------------|
+| `upload-handler.php` | REST-API für Bild-Uploads (POST/DELETE) |
+| `paypal-checkout.php` | PayPal Checkout-Seite |
+| `paypal-process.php` | PayPal Payment Processing Backend |
+| `storage/uploads/bands/` | Upload-Verzeichnis für Band-Bilder |
+| `PAYPAL_UPLOAD_FEATURES.md` | Diese Dokumentation |
+
+## 🔄 Geänderte Dateien
+
+| Datei | Änderungen |
+|-------|------------|
+| `database.sql` | + `payments` Tabelle |
+| `profil.php` | + Galerie-Sektion, + Zahlungsstatus in Anfragen |
+| `anfrage.php` | + PayPal-Button nach erfolgreicher Anfrage |
+
+## 🚀 Deployment-Checklist
+
+- [ ] `storage/uploads/` Verzeichnis erstellen mit Schreibrechten
+- [ ] PayPal Developer Account erstellen
+- [ ] Client-ID in `paypal-checkout.php` eintragen
+- [ ] Admin-Panel: PayPal aktivieren und Service Fee setzen
+- [ ] Für Produktion: Auf Live-Credentials umstellen
+- [ ] SSL-Zertifikat für HTTPS (PayPal requirement)
+
+## 🐛 Bekannte Einschränkungen
+
+1. **PayPal Client-ID**: Muss manuell konfiguriert werden
+2. **Keine Rückerstattungen**: Keine Admin-UI für Refunds
+3. **Email-System**: Aktuell nur Logging, kein echtes SMTP
+4. **Sandbox-Modus**: Standardmäßig aktiviert
+
+## 📝 Nächste Schritte (Optional)
+
+- Webhook-Integration für PayPal IPN (Instant Payment Notification)
+- Admin-Dashboard für Zahlungsübersicht
+- Automatische Rechnungserstellung (PDF)
+- Stripe als alternative Zahlungsmethode
+- Bulk-Upload für mehrere Bilder
+- Bildkompression/Optimierung
+- Thumbnail-Generierung
+
+---
+
+**Entwickelt für**: GetYourBand Platform
+**Datum**: 2025-12-02
+**Version**: 1.0

altcoins/index.php

@@ -0,0 +1,342 @@
+<?php
+$altcoins = [
+    [
+        'name' => 'Ethereum (ETH)',
+        'symbol' => 'ETH',
+        'price' => 3725.42,
+        'ma200' => 3450.15,
+        'last_update' => '2024-04-21 14:00 UTC',
+    ],
+    [
+        'name' => 'BNB',
+        'symbol' => 'BNB',
+        'price' => 598.12,
+        'ma200' => 612.77,
+        'last_update' => '2024-04-21 14:00 UTC',
+    ],
+    [
+        'name' => 'Solana (SOL)',
+        'symbol' => 'SOL',
+        'price' => 158.34,
+        'ma200' => 143.05,
+        'last_update' => '2024-04-21 14:00 UTC',
+    ],
+    [
+        'name' => 'XRP',
+        'symbol' => 'XRP',
+        'price' => 0.57,
+        'ma200' => 0.63,
+        'last_update' => '2024-04-21 14:00 UTC',
+    ],
+    [
+        'name' => 'Dogecoin (DOGE)',
+        'symbol' => 'DOGE',
+        'price' => 0.19,
+        'ma200' => 0.15,
+        'last_update' => '2024-04-21 14:00 UTC',
+    ],
+    [
+        'name' => 'Cardano (ADA)',
+        'symbol' => 'ADA',
+        'price' => 0.48,
+        'ma200' => 0.62,
+        'last_update' => '2024-04-21 14:00 UTC',
+    ],
+    [
+        'name' => 'Avalanche (AVAX)',
+        'symbol' => 'AVAX',
+        'price' => 47.22,
+        'ma200' => 44.61,
+        'last_update' => '2024-04-21 14:00 UTC',
+    ],
+    [
+        'name' => 'Polkadot (DOT)',
+        'symbol' => 'DOT',
+        'price' => 8.81,
+        'ma200' => 7.29,
+        'last_update' => '2024-04-21 14:00 UTC',
+    ],
+    [
+        'name' => 'Chainlink (LINK)',
+        'symbol' => 'LINK',
+        'price' => 17.02,
+        'ma200' => 18.40,
+        'last_update' => '2024-04-21 14:00 UTC',
+    ],
+    [
+        'name' => 'Polygon (MATIC)',
+        'symbol' => 'MATIC',
+        'price' => 0.92,
+        'ma200' => 0.98,
+        'last_update' => '2024-04-21 14:00 UTC',
+    ],
+];
+
+function determineSignal(float $price, float $ma200): array
+{
+    if ($price >= $ma200) {
+        return ['LONG', 'Preis notiert über dem 200-Tage-Durchschnitt.'];
+    }
+
+    return ['SHORT', 'Preis notiert unter dem 200-Tage-Durchschnitt.'];
+}
+
+function formatNumber(float $value, int $decimals = 2): string
+{
+    return number_format($value, $decimals, ',', '.');
+}
+?>
+<!DOCTYPE html>
+<html lang="de">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>Top 10 Altcoins – MA200 Signale</title>
+    <style>
+        :root {
+            color-scheme: light dark;
+            --bg: #0f172a;
+            --fg: #f8fafc;
+            --card: #1e293b;
+            --accent: #10b981;
+            --warning: #f59e0b;
+            --danger: #ef4444;
+            --muted: #94a3b8;
+        }
+
+        * {
+            box-sizing: border-box;
+            font-family: 'Inter', system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+        }
+
+        body {
+            margin: 0;
+            min-height: 100vh;
+            background: radial-gradient(circle at top, rgba(16,185,129,0.25), transparent 55%),
+                var(--bg);
+            color: var(--fg);
+            display: flex;
+            align-items: center;
+            justify-content: center;
+            padding: 2rem 1rem;
+        }
+
+        main {
+            width: min(1100px, 100%);
+            background: rgba(15,23,42,0.85);
+            border: 1px solid rgba(148,163,184,0.2);
+            border-radius: 24px;
+            box-shadow: 0 15px 60px rgba(0,0,0,0.45);
+            padding: 2rem 2.5rem 2.5rem;
+        }
+
+        header {
+            display: flex;
+            flex-direction: column;
+            gap: 0.5rem;
+            margin-bottom: 2rem;
+        }
+
+        header h1 {
+            margin: 0;
+            font-size: clamp(2rem, 4vw, 3rem);
+            line-height: 1.2;
+        }
+
+        header p {
+            margin: 0;
+            color: var(--muted);
+        }
+
+        table {
+            width: 100%;
+            border-collapse: collapse;
+            border-spacing: 0;
+        }
+
+        thead th {
+            text-align: left;
+            font-size: 0.85rem;
+            letter-spacing: 0.08em;
+            text-transform: uppercase;
+            color: var(--muted);
+            border-bottom: 1px solid rgba(148,163,184,0.2);
+            padding-bottom: 0.75rem;
+        }
+
+        tbody td {
+            padding: 1rem 0;
+            border-bottom: 1px solid rgba(148,163,184,0.1);
+        }
+
+        tbody tr:last-child td {
+            border-bottom: none;
+        }
+
+        .symbol {
+            color: var(--muted);
+            font-size: 0.9rem;
+        }
+
+        .price {
+            font-variant-numeric: tabular-nums;
+        }
+
+        .signal {
+            display: inline-flex;
+            align-items: center;
+            gap: 0.5rem;
+            padding: 0.35rem 0.75rem;
+            border-radius: 999px;
+            font-size: 0.9rem;
+            font-weight: 600;
+            letter-spacing: 0.05em;
+        }
+
+        .signal-long {
+            background: rgba(16,185,129,0.15);
+            border: 1px solid rgba(16,185,129,0.5);
+            color: var(--accent);
+        }
+
+        .signal-short {
+            background: rgba(239,68,68,0.15);
+            border: 1px solid rgba(239,68,68,0.5);
+            color: var(--danger);
+        }
+
+        .telegram-card {
+            margin-top: 2rem;
+            background: rgba(30,41,59,0.9);
+            border: 1px solid rgba(59,130,246,0.4);
+            border-radius: 18px;
+            padding: 1.5rem;
+            display: flex;
+            flex-direction: column;
+            gap: 0.75rem;
+        }
+
+        .telegram-card h2 {
+            margin: 0;
+            font-size: 1.2rem;
+        }
+
+        .telegram-card p {
+            margin: 0;
+            color: var(--muted);
+            line-height: 1.5;
+        }
+
+        .telegram-card pre {
+            margin: 0;
+            padding: 1rem;
+            background: rgba(15,23,42,0.8);
+            border-radius: 12px;
+            border: 1px solid rgba(148,163,184,0.15);
+            font-size: 0.9rem;
+            white-space: pre-wrap;
+        }
+
+        @media (max-width: 720px) {
+            main {
+                padding: 1.5rem;
+            }
+
+            table, thead, tbody, tr, td, th {
+                display: block;
+            }
+
+            thead {
+                display: none;
+            }
+
+            tbody tr {
+                border: 1px solid rgba(148,163,184,0.2);
+                border-radius: 18px;
+                padding: 1rem 1.25rem;
+                margin-bottom: 1rem;
+            }
+
+            tbody td {
+                border: none;
+                padding: 0.35rem 0;
+            }
+
+            tbody td::before {
+                content: attr(data-label);
+                display: block;
+                font-size: 0.75rem;
+                letter-spacing: 0.08em;
+                text-transform: uppercase;
+                color: var(--muted);
+                margin-bottom: 0.2rem;
+            }
+        }
+    </style>
+</head>
+<body>
+<main>
+    <header>
+        <h1>Top 10 Altcoins &amp; MA200 Signale</h1>
+        <p>Überblick über mögliche Einstiegszonen basierend auf dem 200-Tage-Durchschnitt. Die Signale (Long oder Short)
+            können direkt an den Telegram-Channel weitergeleitet werden.</p>
+    </header>
+
+    <table>
+        <thead>
+            <tr>
+                <th>Asset</th>
+                <th>Preis (USD)</th>
+                <th>MA200 (USD)</th>
+                <th>Abweichung</th>
+                <th>Signal</th>
+                <th>Zuletzt aktualisiert</th>
+            </tr>
+        </thead>
+        <tbody>
+        <?php foreach ($altcoins as $coin):
+            [$signal, $reason] = determineSignal($coin['price'], $coin['ma200']);
+            $diff = $coin['price'] - $coin['ma200'];
+            $diffPercent = ($coin['ma200'] > 0)
+                ? ($diff / $coin['ma200']) * 100
+                : 0;
+        ?>
+            <tr>
+                <td data-label="Asset">
+                    <strong><?php echo htmlspecialchars($coin['name']); ?></strong>
+                    <div class="symbol"><?php echo htmlspecialchars($coin['symbol']); ?></div>
+                </td>
+                <td data-label="Preis" class="price">$ <?php echo formatNumber($coin['price']); ?></td>
+                <td data-label="MA200" class="price">$ <?php echo formatNumber($coin['ma200']); ?></td>
+                <td data-label="Abweichung">
+                    <?php echo ($diff >= 0 ? '+' : '-') . formatNumber(abs($diff)); ?>
+                    <span class="symbol">(<?php echo ($diffPercent >= 0 ? '+' : '-') . formatNumber(abs($diffPercent)); ?> %)</span>
+                </td>
+                <td data-label="Signal">
+                    <span class="signal signal-<?php echo strtolower($signal); ?>">
+                        <?php echo $signal; ?>
+                    </span>
+                    <div class="symbol"><?php echo $reason; ?></div>
+                </td>
+                <td data-label="Update" class="symbol"><?php echo htmlspecialchars($coin['last_update']); ?></td>
+            </tr>
+        <?php endforeach; ?>
+        </tbody>
+    </table>
+
+    <?php
+    $signals = array_map(function ($coin) {
+        [$signal, $reason] = determineSignal($coin['price'], $coin['ma200']);
+        return sprintf('%s (%s): %s – %s', $coin['name'], $coin['symbol'], $signal, $reason);
+    }, $altcoins);
+    ?>
+
+    <section class="telegram-card">
+        <h2>Telegram Broadcast</h2>
+        <p>Kopiere die Zusammenfassung, um sie in deinem Signal-Channel zu posten, sobald eine MA200-Überschreitung
+            stattfindet.</p>
+        <pre><?php echo htmlspecialchars(implode("\n", $signals)); ?></pre>
+    </section>
+</main>
+</body>
+</html>

anfrage.php

@@ -15,6 +15,8 @@ $user = currentUser();
 $message = '';
 $error = '';
 
+$requestId = null;
+
 if ($_SERVER['REQUEST_METHOD'] === 'POST') {
     $data = [
         'band_id' => $bandId,
@@ -30,6 +32,7 @@ if ($_SERVER['REQUEST_METHOD'] === 'POST') {
         $error = 'Bitte Datum und Ort ausfüllen.';
     } else {
         createRequest($data);
+        $requestId = (int) db()->lastInsertId();
         $message = 'Anfrage gespeichert und an die Band gemeldet.';
         sendEmail('info@' . preg_replace('/\s+/', '', strtolower($band['name'])) . '.ch', 'Neue Anfrage', 'Neue Anfrage für ' . $band['name']);
     }
@@ -52,8 +55,21 @@ $settings = settings();
         <p>PayPal Zahlungsabwicklung ist <?= $settings['paypal_enabled'] === '1' ? 'aktiviert' : 'optional' ?>, Service Fee: <?= htmlspecialchars($settings['service_fee']) ?>%.</p>
     </header>
     <main>
-        <?php if ($message): ?><div class="alert alert-success"><?= htmlspecialchars($message) ?></div><?php endif; ?>
+        <?php if ($message): ?>
+            <div class="alert alert-success">
+                <?= htmlspecialchars($message) ?>
+                <?php if ($requestId && $settings['paypal_enabled'] === '1'): ?>
+                    <div style="margin-top: 1rem;">
+                        <a href="paypal-checkout.php?request_id=<?= $requestId ?>" class="btn-primary" style="display: inline-block; padding: 0.75rem 1.5rem; text-decoration: none;">
+                            Jetzt mit PayPal bezahlen
+                        </a>
+                    </div>
+                <?php endif; ?>
+            </div>
+        <?php endif; ?>
         <?php if ($error): ?><div class="alert alert-error"><?= htmlspecialchars($error) ?></div><?php endif; ?>
+
+        <?php if (!$message): ?>
         <form method="post">
             <label>Event-Datum
                 <input type="date" class="form-control" name="event_date" required>
@@ -72,6 +88,7 @@ $settings = settings();
             </label>
             <button class="btn-primary">Anfrage senden</button>
         </form>
+        <?php endif; ?>
     </main>
 </body>
 </html>

database.sql

@@ -74,3 +74,17 @@ CREATE TABLE IF NOT EXISTS settings (
     key TEXT PRIMARY KEY,
     value TEXT NOT NULL
 );
+
+CREATE TABLE IF NOT EXISTS payments (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    request_id INTEGER NOT NULL,
+    amount REAL NOT NULL,
+    service_fee REAL NOT NULL,
+    total_amount REAL NOT NULL,
+    paypal_order_id TEXT,
+    paypal_payer_id TEXT,
+    status TEXT NOT NULL DEFAULT 'pending',
+    created_at TEXT DEFAULT CURRENT_TIMESTAMP,
+    completed_at TEXT,
+    FOREIGN KEY(request_id) REFERENCES requests(id) ON DELETE CASCADE
+);

functional_test.php

@@ -0,0 +1,307 @@
+#!/usr/bin/env php
+<?php
+declare(strict_types=1);
+
+require_once __DIR__ . '/includes/config.php';
+
+$options = array_slice($argv, 1);
+if (in_array('--fresh', $options, true) && file_exists(DB_PATH)) {
+    unlink(DB_PATH);
+    echo "Bestehende Datenbank entfernt – wird neu initialisiert.\n";
+}
+
+require_once __DIR__ . '/includes/functions.php';
+require_once __DIR__ . '/includes/auth.php';
+require_once __DIR__ . '/includes/email.php';
+
+if (!isset($_SERVER['REQUEST_METHOD'])) {
+    $_SERVER['REQUEST_METHOD'] = 'GET';
+}
+
+final class FunctionalTestRunner
+{
+    private PDO $pdo;
+    private array $results = [];
+    private int $passed = 0;
+    private int $failed = 0;
+
+    public function __construct(PDO $pdo)
+    {
+        $this->pdo = $pdo;
+    }
+
+    public function run(string $title, callable $test, bool $transactional = false): void
+    {
+        try {
+            if ($transactional) {
+                $this->pdo->beginTransaction();
+            }
+            $details = $test($this->pdo);
+            if ($transactional && $this->pdo->inTransaction()) {
+                $this->pdo->rollBack();
+            }
+            $this->record('PASS', $title, $details);
+        } catch (Throwable $e) {
+            if ($transactional && $this->pdo->inTransaction()) {
+                $this->pdo->rollBack();
+            }
+            $this->record('FAIL', $title, $e->getMessage());
+        }
+    }
+
+    private function record(string $status, string $title, ?string $details): void
+    {
+        $status === 'PASS' ? $this->passed++ : $this->failed++;
+        $this->results[] = [
+            'status' => $status,
+            'title' => $title,
+            'details' => $details ?? '',
+        ];
+    }
+
+    public function summary(): void
+    {
+        foreach ($this->results as $result) {
+            $symbol = $result['status'] === 'PASS' ? '\u{2705}' : '\u{274C}';
+            echo sprintf("%s %s\n", $symbol, $result['title']);
+            if ($result['details'] !== '') {
+                echo sprintf("    %s\n", $result['details']);
+            }
+        }
+        echo str_repeat('-', 50) . "\n";
+        echo sprintf("Ergebnis: %d bestanden, %d fehlgeschlagen\n", $this->passed, $this->failed);
+        exit($this->failed === 0 ? 0 : 1);
+    }
+}
+
+function renderPage(string $file, array $get = [], array $post = []): string
+{
+    $previousGet = $_GET ?? [];
+    $previousPost = $_POST ?? [];
+    $previousMethod = $_SERVER['REQUEST_METHOD'] ?? 'GET';
+
+    $_GET = $get;
+    $_POST = $post;
+    $_SERVER['REQUEST_METHOD'] = empty($post) ? 'GET' : 'POST';
+
+    ob_start();
+    include __DIR__ . '/' . ltrim($file, '/');
+    $output = ob_get_clean();
+
+    $_GET = $previousGet;
+    $_POST = $previousPost;
+    $_SERVER['REQUEST_METHOD'] = $previousMethod;
+
+    return $output;
+}
+
+function restartSession(): void
+{
+    if (session_status() === PHP_SESSION_NONE) {
+        session_start();
+    }
+}
+
+$pdo = db();
+$runner = new FunctionalTestRunner($pdo);
+
+$runner->run('Storage-Verzeichnis vorhanden', function () {
+    if (!is_dir(__DIR__ . '/storage')) {
+        throw new RuntimeException('Ordner storage fehlt.');
+    }
+    return 'Pfad: ' . realpath(__DIR__ . '/storage');
+});
+
+$runner->run('Datenbank initialisiert', function (PDO $pdo) {
+    if (!file_exists(DB_PATH)) {
+        throw new RuntimeException('database.sqlite wurde nicht erstellt.');
+    }
+    $tables = $pdo->query("SELECT name FROM sqlite_master WHERE type='table'")
+        ->fetchAll(PDO::FETCH_COLUMN);
+    $required = ['users', 'bands', 'requests', 'reviews', 'settings'];
+    foreach ($required as $table) {
+        if (!in_array($table, $tables, true)) {
+            throw new RuntimeException('Tabelle ' . $table . ' fehlt.');
+        }
+    }
+    return 'Tabellen gefunden: ' . implode(', ', $required);
+});
+
+$runner->run('Seed-Daten verfügbar', function (PDO $pdo) {
+    $users = (int) $pdo->query('SELECT COUNT(*) FROM users')->fetchColumn();
+    $bands = (int) $pdo->query('SELECT COUNT(*) FROM bands')->fetchColumn();
+    if ($users < 3 || $bands < 2) {
+        throw new RuntimeException('Seed-Daten unvollständig.');
+    }
+    return sprintf('Users: %d, Bands: %d', $users, $bands);
+});
+
+$runner->run('Login / Logout Workflow', function () {
+    if (!login('david@example.com', 'secret123')) {
+        throw new RuntimeException('Login schlug fehl.');
+    }
+    $user = currentUser();
+    if (!$user || $user['role'] !== 'kunde') {
+        throw new RuntimeException('Session liefert keinen Kunden.');
+    }
+    logout();
+    restartSession();
+    if (currentUser()) {
+        throw new RuntimeException('Logout hat Session nicht geleert.');
+    }
+    return 'Login erfolgreich für ' . $user['name'];
+});
+
+$runner->run('Band-Filter & Durchschnitt', function () {
+    $bands = allBands(['genre' => 'Funk']);
+    if (!$bands) {
+        throw new RuntimeException('Filter lieferte keine Band.');
+    }
+    $rating = averageRating((int) $bands[0]['id']);
+    if ($rating === null) {
+        throw new RuntimeException('Keine Bewertung vorhanden.');
+    }
+    return sprintf('%d Bands, Ø Bewertung %.1f★', count($bands), $rating);
+});
+
+$runner->run('Medien & Verfügbarkeiten geladen', function () {
+    $media = bandMedia(1);
+    $availability = bandAvailability(1);
+    $reviews = bandReviews(1);
+    if (!$media || !$availability || !$reviews) {
+        throw new RuntimeException('Band 1 hat unvollständige Daten.');
+    }
+    return sprintf('Medien: %d, Slots: %d, Reviews: %d', count($media), count($availability), count($reviews));
+});
+
+$runner->run('Anfrage speichern (Transaktion)', function (PDO $pdo) {
+    $before = (int) $pdo->query('SELECT COUNT(*) FROM requests')->fetchColumn();
+    createRequest([
+        'band_id' => 1,
+        'user_id' => 3,
+        'event_date' => (new DateTimeImmutable('+60 days'))->format('Y-m-d'),
+        'location' => 'Teststadt',
+        'budget' => 4500,
+        'event_type' => 'Testevent',
+        'message' => 'Funktionstest Anfrage',
+    ]);
+    $after = (int) $pdo->query('SELECT COUNT(*) FROM requests')->fetchColumn();
+    if ($after !== $before + 1) {
+        throw new RuntimeException('Anfrage wurde nicht gespeichert.');
+    }
+    return 'Requests gesamt (temporär): ' . $after;
+}, true);
+
+$runner->run('Bewertungen speichern & Eligibility', function (PDO $pdo) {
+    if (!eligibleForReview(1, 3)) {
+        throw new RuntimeException('User 3 sollte berechtigt sein.');
+    }
+    $before = (int) $pdo->query('SELECT COUNT(*) FROM reviews')->fetchColumn();
+    storeReview([
+        'band_id' => 1,
+        'user_id' => 3,
+        'rating' => 4,
+        'comment' => 'Testkommentar',
+    ]);
+    $after = (int) $pdo->query('SELECT COUNT(*) FROM reviews')->fetchColumn();
+    if ($after !== $before + 1) {
+        throw new RuntimeException('Review wurde nicht gespeichert.');
+    }
+    return 'Reviews gesamt (temporär): ' . $after;
+}, true);
+
+$runner->run('Einstellungen lesen & aktualisieren', function () {
+    $current = settings();
+    $originalFee = $current['service_fee'] ?? '0';
+    updateSetting('service_fee', '12');
+    $updated = settings();
+    if (($updated['service_fee'] ?? null) !== '12') {
+        throw new RuntimeException('Service Fee konnte nicht aktualisiert werden.');
+    }
+    updateSetting('service_fee', $originalFee);
+    return 'Service Fee temporär auf 12 gesetzt.';
+}, true);
+
+$runner->run('Moderations-Aktionen', function (PDO $pdo) {
+    changeBandStatus(1, 'prüfung');
+    $status = $pdo->query('SELECT status FROM bands WHERE id = 1')->fetchColumn();
+    if ($status !== 'prüfung') {
+        throw new RuntimeException('Bandstatus änderte sich nicht.');
+    }
+    changeReviewStatus(1, 'gesperrt');
+    $reviewStatus = $pdo->query('SELECT status FROM reviews WHERE id = 1')->fetchColumn();
+    if ($reviewStatus !== 'gesperrt') {
+        throw new RuntimeException('Reviewstatus änderte sich nicht.');
+    }
+    return 'Statusänderungen durchgeführt.';
+}, true);
+
+$runner->run('Registrierung legt Band an', function (PDO $pdo) {
+    $email = 'tester+' . uniqid('', true) . '@example.com';
+    $result = register([
+        'name' => 'Functional Tester',
+        'email' => $email,
+        'password' => 'secret123',
+        'role' => 'band',
+        'city' => 'Testingen',
+        'band_name' => 'QA Ensemble',
+        'genre' => 'QA Funk',
+    ]);
+    if (empty($result['token']) || strlen($result['token']) < 20) {
+        throw new RuntimeException('Verifikationstoken fehlt.');
+    }
+    $user = $pdo->prepare('SELECT id, role FROM users WHERE email = :email');
+    $user->execute([':email' => $email]);
+    $userRow = $user->fetch(PDO::FETCH_ASSOC);
+    if (!$userRow || $userRow['role'] !== 'band') {
+        throw new RuntimeException('User wurde nicht gespeichert.');
+    }
+    $band = $pdo->prepare('SELECT status FROM bands WHERE user_id = :id');
+    $band->execute([':id' => $userRow['id']]);
+    $bandRow = $band->fetch(PDO::FETCH_ASSOC);
+    if (!$bandRow || $bandRow['status'] !== 'prüfung') {
+        throw new RuntimeException('Bandprofil wurde nicht angelegt.');
+    }
+    return 'Token erstellt und Bandstatus "prüfung" bestätigt.';
+}, true);
+
+$runner->run('Startseite rendert fehlerfrei', function () {
+    $html = renderPage('index.php');
+    if (strpos($html, 'Aktive Bands') === false) {
+        throw new RuntimeException('Indexseite liefert keinen Inhalt.');
+    }
+    return 'HTML-Länge: ' . strlen($html) . ' Zeichen';
+});
+
+$runner->run('Band-Detailseite rendert', function () {
+    $html = renderPage('band-detail.php', ['id' => 1]);
+    if (strpos($html, 'Verfügbarkeit') === false) {
+        throw new RuntimeException('Band-Detailseite unvollständig.');
+    }
+    return 'HTML-Länge: ' . strlen($html) . ' Zeichen';
+});
+
+$runner->run('Anfrageformular rendert', function () {
+    $html = renderPage('anfrage.php', ['band_id' => 1]);
+    if (strpos($html, 'Anfrage an') === false) {
+        throw new RuntimeException('Anfrageformular fehlgeschlagen.');
+    }
+    return 'HTML-Länge: ' . strlen($html) . ' Zeichen';
+});
+
+$runner->run('E-Mail Logging (kein Versand)', function () {
+    $logDir = __DIR__ . '/storage/logs';
+    if (!is_dir($logDir)) {
+        mkdir($logDir, 0775, true);
+    }
+    $logFile = $logDir . '/mail.log';
+    $before = file_exists($logFile) ? filesize($logFile) : 0;
+    sendEmail('qa@example.com', 'Functional Test', 'Nur Logeintrag – kein Versand.');
+    $after = filesize($logFile);
+    if ($after <= $before) {
+        throw new RuntimeException('Mail-Log wurde nicht aktualisiert.');
+    }
+    return 'Logeintrag ergänzt, Versand erfolgt nur als Datei.';
+});
+
+$runner->summary();

paypal-checkout.php

@@ -0,0 +1,167 @@
+<?php
+declare(strict_types=1);
+require_once __DIR__ . '/includes/auth.php';
+
+$requestId = isset($_GET['request_id']) ? (int) $_GET['request_id'] : 0;
+if (!$requestId) {
+    http_response_code(400);
+    echo 'Keine Anfrage-ID angegeben';
+    exit;
+}
+
+$user = currentUser();
+
+// Get request details
+$stmt = db()->prepare('SELECT r.*, b.name as band_name, b.price as band_price
+    FROM requests r
+    JOIN bands b ON b.id = r.band_id
+    WHERE r.id = :id AND r.user_id = :user_id');
+$stmt->execute([':id' => $requestId, ':user_id' => $user['id']]);
+$request = $stmt->fetch(PDO::FETCH_ASSOC);
+
+if (!$request) {
+    http_response_code(404);
+    echo 'Anfrage nicht gefunden';
+    exit;
+}
+
+$settings = settings();
+if ($settings['paypal_enabled'] !== '1') {
+    http_response_code(403);
+    echo 'PayPal-Zahlungen sind derzeit nicht aktiviert';
+    exit;
+}
+
+// Calculate amounts
+$bandPrice = (int) $request['band_price'];
+$serviceFeePercent = (float) $settings['service_fee'];
+$serviceFee = $bandPrice * ($serviceFeePercent / 100);
+$totalAmount = $bandPrice + $serviceFee;
+
+// Check if already paid
+$stmt = db()->prepare('SELECT * FROM payments WHERE request_id = :id AND status = "completed"');
+$stmt->execute([':id' => $requestId]);
+$existingPayment = $stmt->fetch(PDO::FETCH_ASSOC);
+
+if ($existingPayment) {
+    $message = 'Diese Buchung wurde bereits bezahlt.';
+}
+?>
+<!DOCTYPE html>
+<html lang="de">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+    <title>PayPal Zahlung – <?= SITE_NAME ?></title>
+    <link rel="stylesheet" href="assets/css/style.css">
+</head>
+<body>
+    <header>
+        <a class="badge" href="profil.php">← Zurück zum Profil</a>
+        <h1>Zahlung für Buchung</h1>
+    </header>
+    <main style="max-width: 600px; margin: 0 auto;">
+        <?php if (isset($message)): ?>
+            <div class="alert alert-success"><?= htmlspecialchars($message) ?></div>
+        <?php else: ?>
+            <h2>Buchungsdetails</h2>
+            <table class="table" style="margin-bottom: 2rem;">
+                <tr><td><strong>Band:</strong></td><td><?= htmlspecialchars($request['band_name']) ?></td></tr>
+                <tr><td><strong>Event-Datum:</strong></td><td><?= htmlspecialchars($request['event_date']) ?></td></tr>
+                <tr><td><strong>Location:</strong></td><td><?= htmlspecialchars($request['location']) ?></td></tr>
+                <tr><td><strong>Event-Typ:</strong></td><td><?= htmlspecialchars($request['event_type']) ?></td></tr>
+            </table>
+
+            <h2>Zahlungsübersicht</h2>
+            <table class="table" style="margin-bottom: 2rem;">
+                <tr><td><strong>Band-Gage:</strong></td><td><?= formatPrice($bandPrice) ?></td></tr>
+                <tr><td><strong>Service Fee (<?= htmlspecialchars($serviceFeePercent) ?>%):</strong></td><td><?= formatPrice((int) $serviceFee) ?></td></tr>
+                <tr style="border-top: 2px solid #ffb703;"><td><strong>Gesamtbetrag:</strong></td><td><strong><?= formatPrice((int) $totalAmount) ?></strong></td></tr>
+            </table>
+
+            <div id="payment-status" style="display:none; padding: 1rem; margin-bottom: 1rem; border-radius: 4px;"></div>
+
+            <!-- PayPal Button Container -->
+            <div id="paypal-button-container" style="margin: 2rem 0;"></div>
+
+            <p style="color: #666; font-size: 0.875rem; margin-top: 2rem;">
+                <strong>Hinweis:</strong> Dies ist eine Demo-Integration. Für die Produktivumgebung benötigen Sie echte PayPal API-Credentials.
+                Aktuell wird im Sandbox-Modus gearbeitet.
+            </p>
+        <?php endif; ?>
+    </main>
+
+    <?php if (!isset($message)): ?>
+    <!-- PayPal SDK -->
+    <script src="https://www.paypal.com/sdk/js?client-id=YOUR_PAYPAL_CLIENT_ID&currency=CHF"></script>
+
+    <script>
+        paypal.Buttons({
+            createOrder: function(data, actions) {
+                return actions.order.create({
+                    purchase_units: [{
+                        amount: {
+                            value: '<?= number_format($totalAmount, 2, '.', '') ?>',
+                            currency_code: 'CHF',
+                            breakdown: {
+                                item_total: {
+                                    value: '<?= number_format($bandPrice, 2, '.', '') ?>',
+                                    currency_code: 'CHF'
+                                },
+                                tax_total: {
+                                    value: '<?= number_format($serviceFee, 2, '.', '') ?>',
+                                    currency_code: 'CHF'
+                                }
+                            }
+                        },
+                        description: 'Buchung: <?= htmlspecialchars($request['band_name']) ?> - <?= htmlspecialchars($request['event_date']) ?>'
+                    }]
+                });
+            },
+            onApprove: function(data, actions) {
+                return actions.order.capture().then(function(details) {
+                    // Save payment to database
+                    const statusDiv = document.getElementById('payment-status');
+                    statusDiv.style.display = 'block';
+                    statusDiv.style.background = '#28a745';
+                    statusDiv.style.color = 'white';
+                    statusDiv.textContent = 'Zahlung erfolgreich! Verarbeite Transaktion...';
+
+                    fetch('paypal-process.php', {
+                        method: 'POST',
+                        headers: { 'Content-Type': 'application/json' },
+                        body: JSON.stringify({
+                            request_id: <?= $requestId ?>,
+                            amount: <?= $bandPrice ?>,
+                            service_fee: <?= number_format($serviceFee, 2, '.', '') ?>,
+                            total_amount: <?= number_format($totalAmount, 2, '.', '') ?>,
+                            paypal_order_id: data.orderID,
+                            paypal_payer_id: details.payer.payer_id
+                        })
+                    })
+                    .then(response => response.json())
+                    .then(result => {
+                        if (result.success) {
+                            statusDiv.textContent = 'Zahlung erfolgreich abgeschlossen! Sie werden weitergeleitet...';
+                            setTimeout(() => {
+                                window.location.href = 'profil.php?payment_success=1';
+                            }, 2000);
+                        } else {
+                            statusDiv.style.background = '#dc3545';
+                            statusDiv.textContent = 'Fehler beim Speichern der Zahlung: ' + result.error;
+                        }
+                    });
+                });
+            },
+            onError: function(err) {
+                const statusDiv = document.getElementById('payment-status');
+                statusDiv.style.display = 'block';
+                statusDiv.style.background = '#dc3545';
+                statusDiv.style.color = 'white';
+                statusDiv.textContent = 'Fehler bei der Zahlung: ' + err;
+            }
+        }).render('#paypal-button-container');
+    </script>
+    <?php endif; ?>
+</body>
+</html>

paypal-process.php

@@ -0,0 +1,95 @@
+<?php
+declare(strict_types=1);
+require_once __DIR__ . '/includes/auth.php';
+require_once __DIR__ . '/includes/email.php';
+requireLogin();
+
+header('Content-Type: application/json');
+
+$user = currentUser();
+
+// Get JSON input
+$input = json_decode(file_get_contents('php://input'), true);
+
+if (!$input || !isset($input['request_id'])) {
+    http_response_code(400);
+    echo json_encode(['error' => 'Ungültige Anfrage']);
+    exit;
+}
+
+$requestId = (int) $input['request_id'];
+$amount = (float) $input['amount'];
+$serviceFee = (float) $input['service_fee'];
+$totalAmount = (float) $input['total_amount'];
+$paypalOrderId = $input['paypal_order_id'] ?? '';
+$paypalPayerId = $input['paypal_payer_id'] ?? '';
+
+// Verify request belongs to user
+$stmt = db()->prepare('SELECT r.*, b.name as band_name, b.user_id as band_user_id
+    FROM requests r
+    JOIN bands b ON b.id = r.band_id
+    WHERE r.id = :id AND r.user_id = :user_id');
+$stmt->execute([':id' => $requestId, ':user_id' => $user['id']]);
+$request = $stmt->fetch(PDO::FETCH_ASSOC);
+
+if (!$request) {
+    http_response_code(404);
+    echo json_encode(['error' => 'Anfrage nicht gefunden']);
+    exit;
+}
+
+// Check if already paid
+$stmt = db()->prepare('SELECT * FROM payments WHERE request_id = :id AND status = "completed"');
+$stmt->execute([':id' => $requestId]);
+if ($stmt->fetch(PDO::FETCH_ASSOC)) {
+    http_response_code(400);
+    echo json_encode(['error' => 'Diese Buchung wurde bereits bezahlt']);
+    exit;
+}
+
+try {
+    // Save payment
+    $stmt = db()->prepare('INSERT INTO payments (request_id, amount, service_fee, total_amount, paypal_order_id, paypal_payer_id, status, completed_at)
+        VALUES (:request_id, :amount, :service_fee, :total_amount, :paypal_order_id, :paypal_payer_id, :status, :completed_at)');
+
+    $stmt->execute([
+        ':request_id' => $requestId,
+        ':amount' => $amount,
+        ':service_fee' => $serviceFee,
+        ':total_amount' => $totalAmount,
+        ':paypal_order_id' => $paypalOrderId,
+        ':paypal_payer_id' => $paypalPayerId,
+        ':status' => 'completed',
+        ':completed_at' => (new DateTimeImmutable())->format('c')
+    ]);
+
+    // Update request status to confirmed
+    $stmt = db()->prepare('UPDATE requests SET status = :status WHERE id = :id');
+    $stmt->execute([':status' => 'bestätigt', ':id' => $requestId]);
+
+    // Send confirmation emails
+    sendEmail($user['email'], 'Zahlungsbestätigung',
+        'Ihre Zahlung für die Buchung von ' . $request['band_name'] . ' wurde erfolgreich verarbeitet.');
+
+    // Notify band
+    if ($request['band_user_id']) {
+        $bandUserStmt = db()->prepare('SELECT email FROM users WHERE id = :id');
+        $bandUserStmt->execute([':id' => $request['band_user_id']]);
+        $bandUser = $bandUserStmt->fetch(PDO::FETCH_ASSOC);
+
+        if ($bandUser) {
+            sendEmail($bandUser['email'], 'Neue bezahlte Buchung',
+                'Sie haben eine neue bezahlte Buchung für ' . $request['event_date'] . ' erhalten.');
+        }
+    }
+
+    echo json_encode([
+        'success' => true,
+        'message' => 'Zahlung erfolgreich verarbeitet',
+        'payment_id' => (int) db()->lastInsertId()
+    ]);
+
+} catch (Exception $e) {
+    http_response_code(500);
+    echo json_encode(['error' => 'Fehler beim Speichern der Zahlung: ' . $e->getMessage()]);
+}

profil.php

@@ -66,20 +66,138 @@ if ($user['role'] === 'band') {
                 </label>
                 <button class="btn-primary">Speichern</button>
             </form>
+
+            <h2 style="margin-top: 2rem;">Band-Galerie</h2>
+            <div id="upload-status" style="display:none; padding: 1rem; margin-bottom: 1rem; background: #28a745; color: white; border-radius: 4px;"></div>
+            <div style="margin-bottom: 1rem;">
+                <label class="btn-primary" style="display: inline-block; cursor: pointer;">
+                    <input type="file" id="image-upload" accept="image/*" style="display: none;">
+                    + Bild hochladen
+                </label>
+                <small style="display: block; margin-top: 0.5rem; color: #666;">Max 5MB (JPG, PNG, GIF, WEBP)</small>
+            </div>
+            <div id="gallery" style="display: grid; grid-template-columns: repeat(auto-fill, minmax(200px, 1fr)); gap: 1rem;">
+                <?php foreach (bandMedia((int) $band['id']) as $media): ?>
+                    <div class="gallery-item" data-media-id="<?= $media['id'] ?>">
+                        <img src="<?= htmlspecialchars($media['url']) ?>" alt="Band Foto" style="width: 100%; height: 200px; object-fit: cover; border-radius: 4px;">
+                        <button class="delete-image" data-id="<?= $media['id'] ?>" style="margin-top: 0.5rem; background: #dc3545; color: white; border: none; padding: 0.5rem 1rem; border-radius: 4px; cursor: pointer; width: 100%;">Löschen</button>
+                    </div>
+                <?php endforeach; ?>
+            </div>
+
+            <script>
+            document.getElementById('image-upload').addEventListener('change', function(e) {
+                const file = e.target.files[0];
+                if (!file) return;
+
+                const formData = new FormData();
+                formData.append('image', file);
+
+                const statusDiv = document.getElementById('upload-status');
+                statusDiv.style.display = 'block';
+                statusDiv.style.background = '#ffc107';
+                statusDiv.textContent = 'Uploading...';
+
+                fetch('upload-handler.php', {
+                    method: 'POST',
+                    body: formData
+                })
+                .then(response => response.json())
+                .then(data => {
+                    if (data.success) {
+                        statusDiv.style.background = '#28a745';
+                        statusDiv.textContent = data.message;
+
+                        // Add to gallery
+                        const gallery = document.getElementById('gallery');
+                        const div = document.createElement('div');
+                        div.className = 'gallery-item';
+                        div.setAttribute('data-media-id', data.id);
+                        div.innerHTML = `
+                            <img src="${data.url}" alt="Band Foto" style="width: 100%; height: 200px; object-fit: cover; border-radius: 4px;">
+                            <button class="delete-image" data-id="${data.id}" style="margin-top: 0.5rem; background: #dc3545; color: white; border: none; padding: 0.5rem 1rem; border-radius: 4px; cursor: pointer; width: 100%;">Löschen</button>
+                        `;
+                        gallery.appendChild(div);
+
+                        setTimeout(() => { statusDiv.style.display = 'none'; }, 3000);
+                    } else {
+                        statusDiv.style.background = '#dc3545';
+                        statusDiv.textContent = data.error;
+                    }
+                })
+                .catch(error => {
+                    statusDiv.style.background = '#dc3545';
+                    statusDiv.textContent = 'Upload fehlgeschlagen: ' + error.message;
+                });
+
+                e.target.value = '';
+            });
+
+            document.addEventListener('click', function(e) {
+                if (e.target.classList.contains('delete-image')) {
+                    if (!confirm('Bild wirklich löschen?')) return;
+
+                    const mediaId = e.target.getAttribute('data-id');
+                    const galleryItem = e.target.closest('.gallery-item');
+
+                    fetch('upload-handler.php', {
+                        method: 'DELETE',
+                        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+                        body: 'media_id=' + mediaId
+                    })
+                    .then(response => response.json())
+                    .then(data => {
+                        if (data.success) {
+                            galleryItem.remove();
+                        } else {
+                            alert(data.error);
+                        }
+                    });
+                }
+            });
+            </script>
         <?php else: ?>
             <p>Du hast noch kein Bandprofil angelegt.</p>
         <?php endif; ?>
 
         <?php if ($user['role'] === 'kunde'): ?>
+            <?php if (isset($_GET['payment_success'])): ?>
+                <div class="alert alert-success">Zahlung erfolgreich abgeschlossen! Vielen Dank für Ihre Buchung.</div>
+            <?php endif; ?>
+
             <h2>Meine Anfragen</h2>
             <table class="table">
-                <thead><tr><th>Band</th><th>Datum</th><th>Status</th></tr></thead>
+                <thead><tr><th>Band</th><th>Datum</th><th>Status</th><th>Zahlung</th><th>Aktion</th></tr></thead>
                 <tbody>
-                    <?php foreach (userRequests((int) $user['id']) as $request): $bandName = findBand((int) $request['band_id']); ?>
+                    <?php
+                    $settings = settings();
+                    foreach (userRequests((int) $user['id']) as $request):
+                        $bandName = findBand((int) $request['band_id']);
+
+                        // Check payment status
+                        $stmt = db()->prepare('SELECT * FROM payments WHERE request_id = :id AND status = "completed"');
+                        $stmt->execute([':id' => $request['id']]);
+                        $payment = $stmt->fetch(PDO::FETCH_ASSOC);
+                    ?>
                         <tr>
                             <td><?= htmlspecialchars($bandName['name'] ?? 'Band #' . $request['band_id']) ?></td>
                             <td><?= htmlspecialchars($request['event_date']) ?></td>
                             <td><?= htmlspecialchars($request['status']) ?></td>
+                            <td>
+                                <?php if ($payment): ?>
+                                    <span style="color: #28a745;">✓ Bezahlt</span><br>
+                                    <small style="color: #666;"><?= formatPrice((int) $payment['total_amount']) ?></small>
+                                <?php else: ?>
+                                    <span style="color: #dc3545;">Ausstehend</span>
+                                <?php endif; ?>
+                            </td>
+                            <td>
+                                <?php if (!$payment && $settings['paypal_enabled'] === '1'): ?>
+                                    <a href="paypal-checkout.php?request_id=<?= $request['id'] ?>" class="badge" style="background: #0070ba; color: white; text-decoration: none;">
+                                        PayPal bezahlen
+                                    </a>
+                                <?php endif; ?>
+                            </td>
                         </tr>
                     <?php endforeach; ?>
                 </tbody>

synth/index.php

@@ -0,0 +1,184 @@
+<?php
+$btcPrice = null;
+$btcChange = null;
+$btcSource = 'https://api.coindesk.com/v1/bpi/currentprice/USD.json';
+try {
+    $response = @file_get_contents($btcSource);
+    if ($response !== false) {
+        $payload = json_decode($response, true);
+        if (isset($payload['bpi']['USD']['rate_float'])) {
+            $btcPrice = (float) $payload['bpi']['USD']['rate_float'];
+        }
+        if (isset($payload['chartName'])) {
+            $btcChange = $payload['chartName'];
+        }
+
+        
+    }
+} catch (Throwable $e) {
+    // Silently ignore network failures, we degrade gracefully in the UI.
+}
+
+
+$btcLabel = $btcPrice ? number_format($btcPrice, 2) . ' $' : 'unbekannt';
+?>
+<!DOCTYPE html>
+<html lang="de">
+<head>
+    <meta charset="UTF-8">
+    <meta name="viewport" content="width=device-width, initial-scale=1.0">
+
+    
+    <title>Mouse Synth Lab</title>
+    <link rel="preconnect" href="https://fonts.googleapis.com">
+    <link rel="preconnect" href="https://fonts.gstatic.com" crossorigin>
+    <link href="https://fonts.googleapis.com/css2?family=Space+Grotesk:wght@400;600&display=swap" rel="stylesheet">
+    <style>
+        :root {
+            color-scheme: dark;
+            font-family: 'Space Grotesk', system-ui, -apple-system, BlinkMacSystemFont, 'Segoe UI', sans-serif;
+            background: radial-gradient(circle at top, #10152b, #050608 60%);
+            color: #e4f6ff;
+        }
+        body {
+            margin: 0;
+            min-height: 100vh;
+            display: flex;
+            flex-direction: column;
+            align-items: center;
+            justify-content: center;
+            gap: 2rem;
+            padding: 2rem;
+        }
+        .panel {
+            background: rgba(15, 18, 40, 0.85);
+            border: 1px solid rgba(102, 204, 255, 0.25);
+            border-radius: 20px;
+            padding: 2rem;
+            width: min(960px, 100%);
+            box-shadow: 0 30px 60px rgba(5, 10, 50, 0.55);
+            backdrop-filter: blur(10px);
+        }
+        h1 {
+            margin: 0 0 1rem 0;
+            font-size: clamp(2rem, 4vw, 3rem);
+            letter-spacing: 0.04em;
+            text-transform: uppercase;
+        }
+        p {
+            margin: 0 0 1rem 0;
+            line-height: 1.6;
+        }
+        .synth-pad {
+            border-radius: 24px;
+            background: linear-gradient(135deg, rgba(35, 58, 122, 0.9), rgba(161, 92, 255, 0.75));
+            border: 1px solid rgba(255,255,255,0.2);
+            height: 320px;
+            position: relative;
+            overflow: hidden;
+            cursor: crosshair;
+        }
+        .synth-pad::after {
+            content: "";
+            position: absolute;
+            inset: 1rem;
+            border: 1px dashed rgba(255,255,255,0.2);
+            border-radius: 18px;
+        }
+        .pad-indicator {
+            position: absolute;
+            width: 20px;
+            height: 20px;
+            border-radius: 50%;
+            border: 2px solid #ffffff;
+            pointer-events: none;
+            transform: translate(-50%, -50%);
+            transition: transform 0.1s ease-out;
+        }
+        .controls {
+            display: grid;
+            grid-template-columns: repeat(auto-fit, minmax(180px, 1fr));
+            gap: 1rem;
+            margin-top: 1.5rem;
+        }
+        label {
+            font-size: 0.85rem;
+            text-transform: uppercase;
+            letter-spacing: 0.1em;
+            color: rgba(255,255,255,0.65);
+        }
+        input[type="range"] {
+            width: 100%;
+        }
+        button {
+            border: none;
+            border-radius: 999px;
+            padding: 0.85rem 1.8rem;
+            font-size: 1rem;
+            cursor: pointer;
+            background: linear-gradient(135deg, #6a5af9, #32d9ff);
+            color: #050608;
+            font-weight: 600;
+            text-transform: uppercase;
+            letter-spacing: 0.08em;
+            transition: transform 0.2s ease, box-shadow 0.2s ease;
+        }
+        button:hover {
+            transform: translateY(-2px);
+            box-shadow: 0 20px 30px rgba(50, 217, 255, 0.3);
+        }
+        .status {
+            font-size: 0.9rem;
+            color: rgba(255,255,255,0.7);
+            display: flex;
+            flex-direction: column;
+            gap: 0.3rem;
+        }
+        .status span {
+            font-weight: 600;
+            color: #7fffd4;
+        }
+    </style>
+</head>
+<body data-btc-price="<?= htmlspecialchars((string) ($btcPrice ?? '')) ?>">
+    <div class="panel">
+        <h1>Mouse Synth Lab</h1>
+        <p>
+            Zieh deine Maus durch den Pad und verwandle Bewegungen in Klang. Drei LFOs,
+            FM-Experimente und ein Delay/Distortion-Hybrid werden live verschaltet.
+            Der aktuelle Bitcoin-Kurs (<strong><?= htmlspecialchars($btcLabel) ?></strong>)
+            steuert, wie aggressiv der Mix moduliert und rückgekoppelt wird.
+        </p>
+        <div class="status" id="btc-status">
+            <div>Bitcoin Quelle: <span><?= htmlspecialchars($btcSource) ?></span></div>
+            <div>Letzter Wert: <span><?= htmlspecialchars($btcLabel) ?></span></div>
+        </div>
+        <div class="controls">
+            <div>
+                <label for="fm-depth">FM-Intensität</label>
+                <input id="fm-depth" type="range" min="10" max="800" value="320">
+            </div>
+            <div>
+                <label for="lfo-speed">LFO-Speed</label>
+                <input id="lfo-speed" type="range" min="0.05" max="18" value="6" step="0.05">
+            </div>
+            <div>
+                <label for="texture">Texture Morph</label>
+                <input id="texture" type="range" min="0" max="1" step="0.01" value="0.4">
+            </div>
+            <div style="display:flex;align-items:end;gap:0.75rem;">
+                <button id="start-btn">Synth starten</button>
+                <button id="randomize-btn" type="button">Chaos Patch</button>
+            </div>
+        </div>
+        <div class="synth-pad" id="synth-pad">
+            <div class="pad-indicator" id="pad-indicator" style="left:50%;top:50%;"></div>
+        </div>
+        <p style="font-size:0.9rem;color:rgba(255,255,255,0.65);margin-top:1.5rem;">
+            Tipp: Halte die Maus gedrückt, damit der AudioContext aktiv bleibt, und lass den Cursor
+            Kreise fahren. Je nach Bitcoin-Laune schalten sich neue Rückkopplungen zu.
+        </p>
+    </div>
+    <script src="synth.js" type="module"></script>
+</body>
+</html>

synth/synth.js

@@ -0,0 +1,262 @@
+const btcPrice = parseFloat(document.body.dataset.btcPrice || 'NaN');
+const normalizedCoin = Number.isFinite(btcPrice)
+  ? Math.min(Math.max((btcPrice - 15000) / 25000, 0), 1)
+  : 0.5;
+
+const pad = document.getElementById('synth-pad');
+const indicator = document.getElementById('pad-indicator');
+const fmDepthInput = document.getElementById('fm-depth');
+const lfoSpeedInput = document.getElementById('lfo-speed');
+const textureInput = document.getElementById('texture');
+const startBtn = document.getElementById('start-btn');
+const randomizeBtn = document.getElementById('randomize-btn');
+
+class MouseSynth {
+  constructor(options = {}) {
+    const AudioContext = window.AudioContext || window.webkitAudioContext;
+    this.ctx = new AudioContext();
+    this.started = false;
+
+    this.coinBlend = options.coinBlend ?? 0.5;
+
+    this.setupNodes();
+    this.#bindEvents();
+  }
+
+  setupNodes() {
+    const ctx = this.ctx;
+
+    this.masterGain = ctx.createGain();
+    this.masterGain.gain.value = 0.0;
+
+    this.carrier = ctx.createOscillator();
+    this.carrier.type = 'sawtooth';
+
+    this.harmonic = ctx.createOscillator();
+    this.harmonic.type = 'triangle';
+    this.harmonic.detune.value = 702; // perfect fifth
+
+    this.fmOsc = ctx.createOscillator();
+    this.fmGain = ctx.createGain();
+    this.fmGain.gain.value = 320;
+
+    this.ampLfo = ctx.createOscillator();
+    this.ampLfo.type = 'sine';
+    this.ampLfo.frequency.value = 6;
+    this.ampLfoGain = ctx.createGain();
+    this.ampLfoGain.gain.value = 0.5;
+
+    this.filterLfo = ctx.createOscillator();
+    this.filterLfo.type = 'triangle';
+    this.filterLfo.frequency.value = 0.5;
+    this.filterLfoGain = ctx.createGain();
+    this.filterLfoGain.gain.value = 800;
+
+    this.sampleHold = ctx.createOscillator();
+    this.sampleHold.type = 'square';
+    this.sampleHold.frequency.value = 8;
+    this.sampleHoldGain = ctx.createGain();
+    this.sampleHoldGain.gain.value = 0.0025;
+
+    this.filter = ctx.createBiquadFilter();
+    this.filter.type = 'bandpass';
+    this.filter.frequency.value = 600;
+    this.filter.Q.value = 8;
+
+    this.delay = ctx.createDelay(1.2);
+    this.delay.delayTime.value = 0.45;
+    this.feedback = ctx.createGain();
+    this.feedback.gain.value = 0.32;
+
+    this.noise = this.#createNoise();
+    this.noiseGain = ctx.createGain();
+    this.noiseGain.gain.value = 0.0;
+
+    this.distortion = ctx.createWaveShaper();
+    this.#setDrive(400);
+
+    this.coinMorph = ctx.createGain();
+    this.coinMorph.gain.value = this.coinBlend;
+
+    this.reverb = ctx.createConvolver();
+    this.reverb.buffer = this.#makeImpulse(2.5);
+    this.reverbGain = ctx.createGain();
+    this.reverbGain.gain.value = 0.25;
+
+    // Connections
+    this.fmOsc.connect(this.fmGain).connect(this.carrier.frequency);
+    this.harmonic.connect(this.filter);
+    this.carrier.connect(this.filter);
+    this.ampLfo.connect(this.ampLfoGain).connect(this.masterGain.gain);
+    this.filterLfo.connect(this.filterLfoGain).connect(this.filter.frequency);
+    this.sampleHold.connect(this.sampleHoldGain).connect(this.filter.detune);
+
+    this.filter.connect(this.distortion);
+    this.noise.connect(this.noiseGain).connect(this.filter);
+
+    const wet = ctx.createGain();
+    const dry = ctx.createGain();
+    this.distortion.connect(dry).connect(this.masterGain);
+    this.distortion.connect(this.delay);
+    this.delay.connect(this.feedback).connect(this.delay);
+    this.delay.connect(this.coinMorph);
+    this.coinMorph.connect(wet);
+    wet.connect(this.reverb);
+    this.reverb.connect(this.reverbGain).connect(this.masterGain);
+
+    this.masterGain.connect(ctx.destination);
+
+    this.carrier.start();
+    this.harmonic.start();
+    this.fmOsc.start();
+    this.ampLfo.start();
+    this.filterLfo.start();
+    this.sampleHold.start();
+    this.noise.start();
+  }
+
+  async start() {
+    if (this.started) return;
+    await this.ctx.resume();
+    this.masterGain.gain.linearRampToValueAtTime(0.8, this.ctx.currentTime + 0.5);
+    this.started = true;
+  }
+
+  #bindEvents() {
+    fmDepthInput.addEventListener('input', () => {
+      this.fmGain.gain.setTargetAtTime(parseFloat(fmDepthInput.value), this.ctx.currentTime, 0.05);
+    });
+
+    lfoSpeedInput.addEventListener('input', () => {
+      const rate = parseFloat(lfoSpeedInput.value);
+      this.ampLfo.frequency.setTargetAtTime(rate, this.ctx.currentTime, 0.1);
+      this.filterLfo.frequency.setTargetAtTime(rate * 0.25, this.ctx.currentTime, 0.1);
+    });
+
+    textureInput.addEventListener('input', () => {
+      this.#updateTexture(parseFloat(textureInput.value));
+    });
+
+    randomizeBtn.addEventListener('click', () => this.randomize());
+  }
+
+  handlePointer(event) {
+    if (!this.started) return;
+    const rect = pad.getBoundingClientRect();
+    const x = (event.clientX - rect.left) / rect.width;
+    const y = (event.clientY - rect.top) / rect.height;
+    const freq = 120 + (1 - y) * 1080;
+
+    this.carrier.frequency.setTargetAtTime(freq, this.ctx.currentTime, 0.05);
+    this.harmonic.frequency.setTargetAtTime(freq * 1.5, this.ctx.currentTime, 0.05);
+    this.filter.frequency.setTargetAtTime(200 + x * 5200, this.ctx.currentTime, 0.08);
+    this.filter.Q.setTargetAtTime(4 + y * 18, this.ctx.currentTime, 0.1);
+    this.noiseGain.gain.setTargetAtTime(x * 0.3, this.ctx.currentTime, 0.2);
+
+    this.sampleHold.frequency.setTargetAtTime(4 + x * 20, this.ctx.currentTime, 0.1);
+    this.delay.delayTime.setTargetAtTime(0.15 + y * 0.6, this.ctx.currentTime, 0.2);
+    this.feedback.gain.setTargetAtTime(0.2 + x * 0.7 * this.coinBlend, this.ctx.currentTime, 0.2);
+    this.coinMorph.gain.setTargetAtTime(this.coinBlend * (0.4 + y * 0.6), this.ctx.currentTime, 0.3);
+    this.fmGain.gain.setTargetAtTime(parseFloat(fmDepthInput.value) + x * 200, this.ctx.currentTime, 0.05);
+    this.#updateTexture(textureInput.value, x, y);
+  }
+
+  handlePointerLeave() {
+    if (!this.started) return;
+    this.masterGain.gain.cancelScheduledValues(this.ctx.currentTime);
+    this.masterGain.gain.setTargetAtTime(0.15, this.ctx.currentTime, 0.5);
+  }
+
+  randomize() {
+    const fm = 80 + Math.random() * 720;
+    fmDepthInput.value = fm.toFixed(0);
+    this.fmGain.gain.setTargetAtTime(fm, this.ctx.currentTime, 0.1);
+
+    const lfo = 0.1 + Math.random() * 16;
+    lfoSpeedInput.value = lfo.toFixed(2);
+    this.ampLfo.frequency.setTargetAtTime(lfo, this.ctx.currentTime, 0.2);
+    this.filterLfo.frequency.setTargetAtTime(lfo * 0.3, this.ctx.currentTime, 0.2);
+
+    const texture = Math.random();
+    textureInput.value = texture.toFixed(2);
+    this.#updateTexture(texture);
+  }
+
+  #updateTexture(value, x = 0.5, y = 0.5) {
+    const amount = parseFloat(value);
+    const drive = 150 + amount * 850 + this.coinBlend * 400;
+    this.#setDrive(drive);
+    const morph = amount * (0.6 + this.coinBlend * 0.8);
+    this.distortion.oversample = morph > 0.5 ? '4x' : '2x';
+    this.reverbGain.gain.setTargetAtTime(0.15 + morph * 0.6, this.ctx.currentTime, 0.3);
+    const filterType = morph > 0.7 ? 'notch' : morph > 0.35 ? 'bandpass' : 'lowpass';
+    this.filter.type = filterType;
+    this.coinMorph.gain.setTargetAtTime(this.coinBlend * (0.4 + morph), this.ctx.currentTime, 0.3);
+    this.delay.delayTime.setTargetAtTime(0.2 + morph * 0.4 + (x * y) * 0.2, this.ctx.currentTime, 0.2);
+  }
+
+  #setDrive(amount) {
+    const curve = new Float32Array(1024);
+    for (let i = 0; i < curve.length; i++) {
+      const x = (i / curve.length) * 2 - 1;
+      curve[i] = Math.tanh(x * amount * 0.01);
+    }
+    this.distortion.curve = curve;
+  }
+
+  #createNoise() {
+    const buffer = this.ctx.createBuffer(1, this.ctx.sampleRate * 4, this.ctx.sampleRate);
+    const data = buffer.getChannelData(0);
+    for (let i = 0; i < data.length; i++) {
+      data[i] = Math.random() * 2 - 1;
+    }
+    const noise = this.ctx.createBufferSource();
+    noise.buffer = buffer;
+    noise.loop = true;
+    return noise;
+  }
+
+  #makeImpulse(seconds) {
+    const rate = this.ctx.sampleRate;
+    const length = rate * seconds;
+    const impulse = this.ctx.createBuffer(2, length, rate);
+    for (let ch = 0; ch < 2; ch++) {
+      const data = impulse.getChannelData(ch);
+      for (let i = 0; i < length; i++) {
+        data[i] = (Math.random() * 2 - 1) * Math.pow(1 - i / length, 2);
+      }
+    }
+    return impulse;
+  }
+}
+
+const synth = new MouseSynth({ coinBlend: normalizedCoin });
+
+startBtn.addEventListener('click', () => synth.start());
+
+pad.addEventListener('pointerdown', async (event) => {
+  await synth.start();
+  pad.setPointerCapture(event.pointerId);
+  indicator.style.opacity = '1';
+});
+
+pad.addEventListener('pointermove', (event) => {
+  indicator.style.left = `${event.offsetX}px`;
+  indicator.style.top = `${event.offsetY}px`;
+  synth.handlePointer(event);
+});
+
+pad.addEventListener('pointerup', (event) => {
+  pad.releasePointerCapture(event.pointerId);
+  synth.handlePointerLeave();
+});
+
+pad.addEventListener('pointerleave', () => synth.handlePointerLeave());
+
+if (!Number.isFinite(btcPrice)) {
+  const status = document.getElementById('btc-status');
+  if (status) {
+    status.insertAdjacentHTML('beforeend', '<div style="color:#ffa3a3;">BTC Feed nicht erreichbar – Synth läuft im Fantasy-Modus.</div>');
+  }
+}
+

upload-handler.php

@@ -0,0 +1,120 @@
+<?php
+declare(strict_types=1);
+require_once __DIR__ . '/includes/auth.php';
+requireLogin();
+
+header('Content-Type: application/json');
+
+$user = currentUser();
+if ($user['role'] !== 'band') {
+    http_response_code(403);
+    echo json_encode(['error' => 'Nur Bands können Bilder hochladen']);
+    exit;
+}
+
+// Get band
+$stmt = db()->prepare('SELECT * FROM bands WHERE user_id = :id');
+$stmt->execute([':id' => $user['id']]);
+$band = $stmt->fetch(PDO::FETCH_ASSOC);
+
+if (!$band) {
+    http_response_code(404);
+    echo json_encode(['error' => 'Kein Bandprofil gefunden']);
+    exit;
+}
+
+if ($_SERVER['REQUEST_METHOD'] === 'POST' && isset($_FILES['image'])) {
+    $file = $_FILES['image'];
+
+    // Validate file
+    $allowedTypes = ['image/jpeg', 'image/png', 'image/gif', 'image/webp'];
+    $maxSize = 5 * 1024 * 1024; // 5MB
+
+    if (!in_array($file['type'], $allowedTypes)) {
+        http_response_code(400);
+        echo json_encode(['error' => 'Ungültiger Dateityp. Erlaubt sind: JPG, PNG, GIF, WEBP']);
+        exit;
+    }
+
+    if ($file['size'] > $maxSize) {
+        http_response_code(400);
+        echo json_encode(['error' => 'Datei zu groß (max 5MB)']);
+        exit;
+    }
+
+    if ($file['error'] !== UPLOAD_ERR_OK) {
+        http_response_code(500);
+        echo json_encode(['error' => 'Upload-Fehler']);
+        exit;
+    }
+
+    // Generate unique filename
+    $extension = pathinfo($file['name'], PATHINFO_EXTENSION);
+    $filename = 'band_' . $band['id'] . '_' . uniqid() . '.' . $extension;
+    $uploadPath = __DIR__ . '/storage/uploads/bands/' . $filename;
+
+    // Move file
+    if (!move_uploaded_file($file['tmp_name'], $uploadPath)) {
+        http_response_code(500);
+        echo json_encode(['error' => 'Datei konnte nicht gespeichert werden']);
+        exit;
+    }
+
+    // Save to database
+    $url = 'storage/uploads/bands/' . $filename;
+    $stmt = db()->prepare('INSERT INTO band_media (band_id, type, url) VALUES (:band_id, :type, :url)');
+    $stmt->execute([
+        ':band_id' => $band['id'],
+        ':type' => 'image',
+        ':url' => $url
+    ]);
+
+    $mediaId = (int) db()->lastInsertId();
+
+    echo json_encode([
+        'success' => true,
+        'id' => $mediaId,
+        'url' => $url,
+        'message' => 'Bild erfolgreich hochgeladen'
+    ]);
+    exit;
+}
+
+// Delete image
+if ($_SERVER['REQUEST_METHOD'] === 'DELETE') {
+    parse_str(file_get_contents('php://input'), $deleteData);
+    $mediaId = (int) ($deleteData['media_id'] ?? 0);
+
+    if (!$mediaId) {
+        http_response_code(400);
+        echo json_encode(['error' => 'Keine Media-ID angegeben']);
+        exit;
+    }
+
+    // Check ownership
+    $stmt = db()->prepare('SELECT * FROM band_media WHERE id = :id AND band_id = :band_id');
+    $stmt->execute([':id' => $mediaId, ':band_id' => $band['id']]);
+    $media = $stmt->fetch(PDO::FETCH_ASSOC);
+
+    if (!$media) {
+        http_response_code(404);
+        echo json_encode(['error' => 'Bild nicht gefunden']);
+        exit;
+    }
+
+    // Delete file
+    $filePath = __DIR__ . '/' . $media['url'];
+    if (file_exists($filePath) && strpos($media['url'], 'storage/uploads/') === 0) {
+        unlink($filePath);
+    }
+
+    // Delete from database
+    $stmt = db()->prepare('DELETE FROM band_media WHERE id = :id');
+    $stmt->execute([':id' => $mediaId]);
+
+    echo json_encode(['success' => true, 'message' => 'Bild gelöscht']);
+    exit;
+}
+
+http_response_code(400);
+echo json_encode(['error' => 'Ungültige Anfrage']);