Refactor: Plausible-Konfiguration aktualisiert und twitterHandle entfernt

- Defaults auf neue Domains aktualisiert (hoerdle.de statt hoerdle.elpatron.me)
- CSP in proxy.ts konfigurierbar gemacht (liest Plausible-URL aus Umgebungsvariablen)
- twitterHandle entfernt (wurde nirgendwo verwendet)
- Dokumentation aktualisiert

proxy.ts

@@ -21,16 +21,41 @@ export default function proxy(request: NextRequest) {
     headers.set('Referrer-Policy', 'strict-origin-when-cross-origin');
     headers.set('Permissions-Policy', 'camera=(), microphone=(), geolocation=()');
 
+    // Extract Plausible domain from script URL for CSP
+    const plausibleScriptSrc = process.env.NEXT_PUBLIC_PLAUSIBLE_SCRIPT_SRC || 'https://plausible.example.com/js/script.js';
+    let plausibleOrigin = 'https://plausible.example.com';
+    try {
+        const url = new URL(plausibleScriptSrc);
+        plausibleOrigin = url.origin;
+    } catch {
+        // If URL parsing fails, try to extract domain manually
+        const match = plausibleScriptSrc.match(/https?:\/\/([^/]+)/);
+        if (match) {
+            plausibleOrigin = `https://${match[1]}`;
+        }
+    }
+
+    // Get other service URLs from environment (only add to CSP if configured)
+    const gotifyUrl = process.env.GOTIFY_URL;
+    const openrouterUrl = process.env.NEXT_PUBLIC_OPENROUTER_URL || 'https://openrouter.ai';
+
+    // Build CSP dynamically based on environment variables
+    const connectSrcParts = ["'self'", openrouterUrl, plausibleOrigin];
+    if (gotifyUrl && !gotifyUrl.includes('example.com')) {
+        connectSrcParts.push(gotifyUrl);
+    }
+
     const csp = [
         "default-src 'self'",
-        "script-src 'self' 'unsafe-inline' 'unsafe-eval' https://plausible.elpatron.me",
+        `script-src 'self' 'unsafe-inline' 'unsafe-eval' ${plausibleOrigin}`,
         "style-src 'self' 'unsafe-inline'",
         "img-src 'self' data: blob:",
         "font-src 'self' data:",
-        "connect-src 'self' https://openrouter.ai https://gotify.example.com https://plausible.elpatron.me",
+        `connect-src ${connectSrcParts.join(' ')}`,
         "media-src 'self' blob:",
         "frame-ancestors 'self'",
     ].join('; ');
+
     headers.set('Content-Security-Policy', csp);
 
     return response;