fix(quick-261009-p0m): Abhaengigkeiten innerhalb der Hauptversionen aktualisiert, zwei unbenutzte entfernt

- Next.js 15.5.27, NestJS 11.2.7 (multer 2.4.0), nodemailer 9.1.1, undici 7.30.0 exakt, adm-zip 0.6.1, csv-parse 7.0.3, vitest (web) 4.1.11
- 15 pnpm-Overrides fuer mittelbare Bausteine, nur innerhalb derselben Hauptversion
- @nestjs-modules/mailer und ews-javascript-api entfernt (kein Import), Kommentare berichtigt
- Desktop: rustls 0.23.45 (mit rustls-webpki 0.103.15)
- pnpm audit --prod: 151 (5 kritisch, 73 hoch) -> 12 (0 kritisch, 9 hoch)
- Sicherheitsprotokoll, Entwicklungsanleitung und CHANGELOG nachgefuehrt

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

apps/api/package.json

@@ -14,33 +14,31 @@
   },
   "dependencies": {
     "@microsoft/microsoft-graph-client": "3.0.7",
-    "@nestjs-modules/mailer": "^2.3.7",
-    "@nestjs/common": "^11.0.0",
+    "@nestjs/common": "^11.2.7",
     "@nestjs/config": "^4.0.0",
-    "@nestjs/core": "^11.0.0",
+    "@nestjs/core": "^11.2.7",
     "@nestjs/jwt": "^11.0.2",
     "@nestjs/mapped-types": "^2.1.1",
     "@nestjs/passport": "^11.0.5",
-    "@nestjs/platform-express": "^11.0.0",
+    "@nestjs/platform-express": "^11.2.7",
     "@nestjs/schedule": "^6.1.3",
     "@prisma/client": "^6.0.0",
     "@tessera/shared": "workspace:*",
-    "adm-zip": "^0.6.0",
+    "adm-zip": "^0.6.1",
     "argon2": "^0.44.0",
     "cheerio": "^1.2.0",
     "class-transformer": "^0.5.1",
     "class-validator": "^0.15.1",
     "cookie-parser": "^1.4.7",
     "cron": "4.4.0",
-    "csv-parse": "^7.0.1",
-    "ews-javascript-api": "0.15.3",
+    "csv-parse": "^7.0.3",
     "fast-xml-parser": "^5.10.1",
     "httpntlm": "^1.8.13",
     "imapflow": "^1.4.3",
     "ldapts": "^8.1.8",
     "node-forge": "^1.4.0",
     "node-ical": "0.26.1",
-    "nodemailer": "^9.0.1",
+    "nodemailer": "^9.1.1",
     "passport": "^0.7.0",
     "passport-jwt": "^4.0.1",
     "passport-local": "^1.0.0",
@@ -49,7 +47,7 @@
     "reflect-metadata": "^0.2.0",
     "rxjs": "^7.0.0",
     "tsdav": "2.2.2",
-    "undici": "7.28.0",
+    "undici": "7.30.0",
     "xlsx": "^0.18.5"
   },
   "devDependencies": {

apps/api/src/calendar/providers/exchange.provider.ts

@@ -110,7 +110,7 @@ function ntlmPost(opts: NtlmOptions): Promise<{ statusCode: number; body: string
  * Exchange calendar provider — dispatches on exchangeMode ('graph' vs 'ews').
  *
  * - 'graph': Uses @microsoft/microsoft-graph-client for Exchange Online / M365
- * - 'ews': Uses ews-javascript-api for on-premise Exchange Server
+ * - 'ews': Uses raw SOAP over NTLM (httpntlm) for on-premise Exchange Server
  *
  * Both modes gracefully degrade: on auth failure, returns empty array and
  * surfaces a generic error (no credential details — Security V7 / T-05-13).

apps/api/src/mail/mail.module.ts

@@ -21,8 +21,8 @@ import { MailService } from './mail.service';
  *   4. Final hardcoded fallback: localhost:1025 (Mailhog / dev default)
  *
  * No circular import risk: MailModule -> SettingsModule -> CalendarModule
- * (no reverse edges). `@nestjs-modules/mailer` bleibt als Paket installiert,
- * wird aber von keinem Modul mehr benutzt.
+ * (no reverse edges). Das fruehere Paket `@nestjs-modules/mailer` ist entfernt
+ * (quick-261009-p0m); versendet wird ausschliesslich ueber nodemailer.
  */
 @Module({
   imports: [SettingsModule],