Document review fixes and harden mail actions

backend/09-smtp_test.go

@@ -0,0 +1,12 @@
+package backend
+
+import "testing"
+
+func TestCleanMailHeaderRejectsLineBreaks(t *testing.T) {
+	if _, err := cleanMailHeader("Betreff\r\nBcc: attacker@example.com"); err == nil {
+		t.Fatal("expected CRLF header injection to be rejected")
+	}
+	if got, err := cleanMailHeader("  Normaler Betreff  "); err != nil || got != "Normaler Betreff" {
+		t.Fatalf("cleanMailHeader returned %q, %v", got, err)
+	}
+}