refactor(esm): migrate server and tests from CommonJS to ESM

Convert all server/, test, and setup files from require()/module.exports
to import/export syntax. Activate ESM globally via "type": "module" in
package.json and load dotenv via --import dotenv/config in npm scripts.

server/middleware/csrf.js

@@ -11,9 +11,7 @@
  *   5. GET/HEAD/OPTIONS sind ausgenommen (safe methods).
  */
 
-'use strict';
-
-const crypto = require('node:crypto');
+import crypto from 'node:crypto';
 
 const TOKEN_LENGTH = 32; // Bytes → 64 Hex-Zeichen
 
@@ -68,4 +66,4 @@ function csrfMiddleware(req, res, next) {
   next();
 }
 
-module.exports = { csrfMiddleware, generateToken };
+export { csrfMiddleware, generateToken };