fix: security and UX improvements for notifications and shares

- Add ownership checks on all notification and share routes (403 Forbidden)
- Validate permission field (only view/edit/admin allowed)
- Remove user_id from POST notifications (only self-notifications)
- Add getNotification/getProjectShare to DB interface + adapter
- Add res.ok checks on all frontend API calls
- Add click-outside handler for notification dropdown
- Add initial notification load on mount for badge count
- Add email validation + duplicate check in ShareDialog
- Add Enter key handler in ShareDialog
- Add submitting state to prevent double-click
- Guard against null token in Dashboard

frontend/src/pages/Dashboard.tsx

@@ -90,7 +90,7 @@ export function Dashboard({ onOpenProject }: DashboardProps) {
           <span className="dashboard-user">{user?.name} ({user?.role})</span>
         </div>
         <div className="dashboard-header-actions">
-          <NotificationPanel token={token!} />
+          {token && <NotificationPanel token={token} />}
           <button className="dashboard-logout" onClick={logout}>Abmelden</button>
         </div>
       </header>
@@ -160,12 +160,14 @@ export function Dashboard({ onOpenProject }: DashboardProps) {
         )}
       </div>
 
-      <ShareDialog
-        token={token!}
-        projectId={shareProjectId ?? ''}
-        open={!!shareProjectId}
-        onClose={() => setShareProjectId(null)}
-      />
+      {token && (
+        <ShareDialog
+          token={token}
+          projectId={shareProjectId ?? ''}
+          open={!!shareProjectId}
+          onClose={() => setShareProjectId(null)}
+        />
+      )}
     </div>
   );
 }