docs: add browser console error screenshots for Ping Service debugging

- Uploaded browser console logs and related error screenshots to document debugging efforts for Ping Service issues.
- Captured CORS-related errors, database initialization logs, and WebGL warnings for local environment analysis.

Signed-off-by: Stefan Mogeritsch <stefan.mo.co@gmail.com>

backend/infrastructure/security/src/main/kotlin/at/mocode/infrastructure/security/GlobalSecurityConfig.kt

@@ -8,60 +8,46 @@ import org.springframework.security.config.annotation.web.configuration.EnableWe
 import org.springframework.security.config.http.SessionCreationPolicy
 import org.springframework.security.oauth2.server.resource.authentication.JwtAuthenticationConverter
 import org.springframework.security.web.SecurityFilterChain
-import org.springframework.web.cors.CorsConfiguration
-import org.springframework.web.cors.CorsConfigurationSource
-import org.springframework.web.cors.UrlBasedCorsConfigurationSource
 
 @Configuration
 @EnableWebSecurity
 @EnableMethodSecurity(prePostEnabled = true) // Erlaubt @PreAuthorize in Services/Controllern
 class GlobalSecurityConfig {
 
-    @Bean
-    fun filterChain(http: HttpSecurity): SecurityFilterChain {
-        http
-            .csrf { it.disable() } // CSRF nicht nötig für Stateless REST APIs
-            .cors { it.configurationSource(corsConfigurationSource()) }
-            .sessionManagement { it.sessionCreationPolicy(SessionCreationPolicy.STATELESS) }
-            .authorizeHttpRequests { auth ->
-                // Explizite Freigaben (Health, Info, Public Endpoints)
-                auth.requestMatchers("/actuator/**").permitAll()
-                auth.requestMatchers("/ping/public").permitAll()
-                auth.requestMatchers("/ping/simple").permitAll()
-                auth.requestMatchers("/ping/enhanced").permitAll()
-                auth.requestMatchers("/ping/health").permitAll()
-                auth.requestMatchers("/error").permitAll()
+  @Bean
+  fun filterChain(http: HttpSecurity): SecurityFilterChain {
+    http
+      .csrf { it.disable() } // CSRF nicht nötig für Stateless REST APIs
+      // WICHTIG: CORS explizit deaktivieren!
+      // Das API-Gateway kümmert sich um CORS. Die Microservices dürfen KEINE
+      // Access-Control-Allow-Origin Header setzen, sonst haben wir doppelte Header beim Client.
+      .cors { it.disable() }
+      .sessionManagement { it.sessionCreationPolicy(SessionCreationPolicy.STATELESS) }
+      .authorizeHttpRequests { auth ->
+        // Explizite Freigaben (Health, Info, Public Endpoints)
+        auth.requestMatchers("/actuator/**").permitAll()
+        auth.requestMatchers("/ping/public").permitAll()
+        auth.requestMatchers("/ping/simple").permitAll()
+        auth.requestMatchers("/ping/enhanced").permitAll()
+        auth.requestMatchers("/ping/health").permitAll()
+        auth.requestMatchers("/error").permitAll()
 
-                // Alles andere muss authentifiziert sein
-                auth.anyRequest().authenticated()
-            }
-            .oauth2ResourceServer { oauth2 ->
-                oauth2.jwt { jwt ->
-                    jwt.jwtAuthenticationConverter(jwtAuthenticationConverter())
-                }
-            }
+        // Alles andere muss authentifiziert sein
+        auth.anyRequest().authenticated()
+      }
+      .oauth2ResourceServer { oauth2 ->
+        oauth2.jwt { jwt ->
+          jwt.jwtAuthenticationConverter(jwtAuthenticationConverter())
+        }
+      }
 
-        return http.build()
-    }
+    return http.build()
+  }
 
-    @Bean
-    fun jwtAuthenticationConverter(): JwtAuthenticationConverter {
-        val converter = JwtAuthenticationConverter()
-        converter.setJwtGrantedAuthoritiesConverter(KeycloakRoleConverter())
-        return converter
-    }
-
-    @Bean
-    fun corsConfigurationSource(): CorsConfigurationSource {
-        val configuration = CorsConfiguration()
-        // Erlaube Frontend (localhost, docker host)
-        configuration.allowedOriginPatterns = listOf("*") // Für Dev; in Prod einschränken!
-        configuration.allowedMethods = listOf("GET", "POST", "PUT", "DELETE", "OPTIONS")
-        configuration.allowedHeaders = listOf("*")
-        configuration.allowCredentials = true
-
-        val source = UrlBasedCorsConfigurationSource()
-        source.registerCorsConfiguration("/**", configuration)
-        return source
-    }
+  @Bean
+  fun jwtAuthenticationConverter(): JwtAuthenticationConverter {
+    val converter = JwtAuthenticationConverter()
+    converter.setJwtGrantedAuthoritiesConverter(KeycloakRoleConverter())
+    return converter
+  }
 }