security: add HTTP security headers, rate limiting on sensitive routes, and file upload extension validation

routes/web.php

@@ -20,8 +20,12 @@ use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Route;
 use Illuminate\Support\Facades\Schema;
 
-// Health & Diagnostics
+// Health & Diagnostics (Alleen toegankelijk in debug-modus of voor ingelogde admins)
 Route::get('/health-debug', function () {
+    if (! config('app.debug') && ! (auth()->check() && auth()->user()->isAdmin())) {
+        abort(404);
+    }
+
     $dbPath = config('database.connections.sqlite.database');
 
     $diagnostics = [
@@ -78,23 +82,23 @@ Route::get('/winkelwagen/aantal', [CartController::class, 'count'])->name('cart.
 
 // Afrekenen & Bevestiging
 Route::get('/afrekenen', [CheckoutController::class, 'index'])->name('checkout.index');
-Route::post('/afrekenen', [CheckoutController::class, 'store'])->name('checkout.store');
+Route::post('/afrekenen', [CheckoutController::class, 'store'])->name('checkout.store')->middleware('throttle:10,1');
 Route::get('/bestelling-ontvangen/{orderNumber}', [CheckoutController::class, 'success'])->name('checkout.success');
 
 // Authenticatie & Klantenportaal
 Route::middleware('guest')->group(function () {
     Route::get('/inloggen', [LoginController::class, 'showLoginForm'])->name('login');
-    Route::post('/inloggen', [LoginController::class, 'login'])->name('login.submit');
+    Route::post('/inloggen', [LoginController::class, 'login'])->name('login.submit')->middleware('throttle:5,1');
     Route::redirect('/login', '/inloggen');
 
     Route::get('/registreren', [RegisterController::class, 'showRegistrationForm'])->name('register');
-    Route::post('/registreren', [RegisterController::class, 'register'])->name('register.submit');
+    Route::post('/registreren', [RegisterController::class, 'register'])->name('register.submit')->middleware('throttle:6,1');
     Route::redirect('/register', '/registreren');
 
     Route::get('/wachtwoord-vergeten', [ForgotPasswordController::class, 'showLinkRequestForm'])->name('password.request');
-    Route::post('/wachtwoord-vergeten', [ForgotPasswordController::class, 'sendResetLinkEmail'])->name('password.email');
+    Route::post('/wachtwoord-vergeten', [ForgotPasswordController::class, 'sendResetLinkEmail'])->name('password.email')->middleware('throttle:3,1');
     Route::get('/wachtwoord-resetten/{token}', [ForgotPasswordController::class, 'showResetForm'])->name('password.reset');
-    Route::post('/wachtwoord-resetten', [ForgotPasswordController::class, 'reset'])->name('password.update');
+    Route::post('/wachtwoord-resetten', [ForgotPasswordController::class, 'reset'])->name('password.update')->middleware('throttle:5,1');
 });
 
 Route::middleware('auth')->group(function () {