Add security comments to path handling in various scripts to clarify internal constant usage and mitigate path traversal risks. Update logging in registration and verification processes for improved clarity.

server/api/auth/register-passkey-options.post.js

@@ -133,7 +133,7 @@ export default defineEventHandler(async (event) => {
   })
   
   const optionsDuration = Date.now() - optionsStart
-  console.log(`[DEBUG] Registration options generated (${optionsDuration}ms)`, {
+  console.log('[DEBUG] Registration options generated', { optionsDurationMs: optionsDuration,
     hasChallenge: !!options.challenge,
     challengeLength: options.challenge?.length,
     rpId: options.rp?.id,
@@ -185,7 +185,7 @@ export default defineEventHandler(async (event) => {
   const totalDuration = Date.now() - requestStart
   
   // Debug: Prüfe die vollständige Options-Struktur
-  console.log(`[DEBUG] Returning options (total: ${totalDuration}ms)`, {
+  console.log('[DEBUG] Returning options', { totalDurationMs: totalDuration,
     registrationId,
     optionsKeys: Object.keys(options),
     challengeLength: options.challenge?.length,