Implement BugHunter game

src/main/resources/bughunter/content.json

@@ -0,0 +1,43 @@
+{
+  "hunts": [
+    {
+      "slug": "falsche-rechnung", "title": "Fall #1: Die falsche Rechnung", "language": "Java", "difficulty": "junior", "examScope": "AP1",
+      "description": "Eine Rechnung liefert im letzten Monat einen falschen Wert.", "briefing": "Die Monatsauswertung soll alle zwölf Monate addieren. Das Ticket nennt nur einen fehlenden Dezemberwert.", "consoleOutput": "[report] Summe 2025: 11 Monate verarbeitet\n[warn] Erwartet: 12 Monatswerte",
+      "files": [{"filename":"Jahresreport.java","content":"public class Jahresreport {\n    static int summe(int[] monate) {\n        int total = 0;\n        for (int i = 0; i <= monate.length; i++) {\n            total += monate[i];\n        }\n        return total;\n    }\n}"}],
+      "bugs": [{"points":100,"file":"Jahresreport.java","line":4,"category":"logik","evidence":"Die Schleife greift nach dem letzten Array-Element zu.","fixOptions":["for (int i = 0; i < monate.length; i++) {","for (int i = 1; i <= monate.length; i++) {","for (int i = 0; i <= monate.length - 1; i += 2) {","for (int i = monate.length; i >= 0; i--) {"],"fixIndex":0,"fixedLine":"        for (int i = 0; i < monate.length; i++) {","explanation":"Bei Arrays ist der letzte gültige Index length - 1. Mit < length werden alle Elemente genau einmal verarbeitet."}]
+    },
+    {
+      "slug": "ampel-bleibt-rot", "title": "Fall #2: Die sture Ampel", "language": "Java", "difficulty": "junior", "examScope": "AP1",
+      "description": "Die Ampel zeigt immer Rot – selbst bei einer grünen Konfiguration.", "briefing": "Im Schulungsprojekt wird der Status aus einer Konfigurationsdatei gelesen.", "consoleOutput": "Status aus config: green\nUI-Ausgabe: ROT",
+      "files": [{"filename":"Ampel.java","content":"public class Ampel {\n    static String anzeigen(String status) {\n        if (status = \"green\") {\n            return \"GRÜN\";\n        }\n        return \"ROT\";\n    }\n}"}],
+      "bugs": [{"points":100,"file":"Ampel.java","line":3,"category":"syntax","evidence":"Der Vergleich verändert den Wert statt zwei Werte zu vergleichen.","fixOptions":["if (\"green\".equals(status)) {","if (status := \"green\") {","if (status.equals = \"green\") {","if (status =! \"green\") {"],"fixIndex":0,"fixedLine":"        if (\"green\".equals(status)) {","explanation":"equals vergleicht Zeichenketten. Die Literalkonstante links verhindert zusätzlich eine NullPointerException."}]
+    },
+    {
+      "slug": "menue-fallt-durch", "title": "Fall #3: Das fallende Menü", "language": "Java", "difficulty": "junior", "examScope": "AP1",
+      "description": "Der Punkt ‚Status‘ öffnet unerwartet den Abmelde-Dialog.", "briefing": "Ein Azubi meldet einen Fehler im Konsolenmenü. Prüfe die Verzweigungen.", "consoleOutput": "Eingabe: 2\nStatus: OK\nAbmeldung gestartet",
+      "files": [{"filename":"Menue.java","content":"switch (auswahl) {\n    case 1:\n        System.out.println(\"Start\");\n        break;\n    case 2:\n        System.out.println(\"Status: OK\");\n    case 3:\n        System.out.println(\"Abmeldung gestartet\");\n        break;\n    default:\n        System.out.println(\"Ungültig\");\n}"}],
+      "bugs": [{"points":100,"file":"Menue.java","line":6,"category":"logik","evidence":"Nach dem Status-Fall wird der nächste case ebenfalls ausgeführt.","fixOptions":["        break;","        continue;","        return false;","        case 2: break;"],"fixIndex":0,"fixedLine":"        break;","explanation":"Ohne break fällt ein switch in den nächsten Fall durch (fall-through)."}]
+    },
+    {
+      "slug": "absturz-um-mitternacht", "title": "Fall #4: Der Absturz um Mitternacht", "language": "Java", "difficulty": "senior", "examScope": "AP2_FIAE",
+      "description": "Ein nächtlicher Job stürzt sporadisch ab.", "briefing": "Der Job läuft um 00:00 Uhr. Der Stacktrace zeigt auf die Formatierung des letzten Ereignisses.", "consoleOutput": "java.lang.NullPointerException: Cannot invoke \"String.toUpperCase()\"\n  at Nachtjob.letztesEreignis(Nachtjob.java:5)\n  at Nachtjob.main(Nachtjob.java:10)",
+      "files": [{"filename":"Nachtjob.java","content":"public class Nachtjob {\n    static String letztesEreignis(String event) {\n        if (event == null) {\n            System.out.println(\"Kein Ereignis vorhanden\");\n        }\n        return event.toUpperCase();\n    }\n\n    public static void main(String[] args) {\n        System.out.println(letztesEreignis(null));\n    }\n}"}],
+      "bugs": [{"points":150,"file":"Nachtjob.java","line":5,"category":"laufzeit","evidence":"Der Stacktrace verweist direkt auf toUpperCase in Zeile 5.","fixOptions":["            return \"KEIN EREIGNIS\";","            event = event.toUpperCase();","            throw new NullPointerException();","            System.out.println(event.toUpperCase());"],"fixIndex":0,"fixedLine":"            return \"KEIN EREIGNIS\";","explanation":"Nach der Null-Prüfung muss die Methode einen sicheren Ersatzwert zurückgeben, bevor event verwendet wird."}]
+    },
+    {
+      "slug": "offenes-login", "title": "Fall #5: Das offene Login", "language": "PHP", "difficulty": "senior", "examScope": "AP2_FIAE",
+      "description": "Ein Sicherheitscheck meldet eine manipulierbare Login-Abfrage.", "briefing": "Die Eingabe eines Benutzernamens landet direkt in der SQL-Abfrage. Finde die Schwachstelle und wähle den sicheren Fix.", "consoleOutput": "Scanner: CWE-89 SQL Injection\nTest-Eingabe: ' OR '1'='1",
+      "files": [{"filename":"login.php","content":"<?php\nfunction login($pdo, $name) {\n    $sql = \"SELECT id FROM users WHERE name = '$name'\";\n    return $pdo->query($sql)->fetch();\n}\n?>"}],
+      "bugs": [{"points":150,"file":"login.php","line":3,"category":"sicherheit","evidence":"Der externe Wert $name wird in einen SQL-String interpoliert.","fixOptions":["    $stmt = $pdo->prepare('SELECT id FROM users WHERE name = ?'); $stmt->execute([$name]);","    $name = addslashes($name); $sql = \"SELECT id FROM users WHERE name = '$name'\";","    $sql = \"SELECT id FROM users WHERE name LIKE '%$name%'\";","    $sql = \"SELECT id FROM users WHERE name = \" . $name;"],"fixIndex":0,"fixedLine":"    $stmt = $pdo->prepare('SELECT id FROM users WHERE name = ?'); $stmt->execute([$name]);","explanation":"Prepared Statements trennen SQL-Code und Nutzdaten. Escaping allein ist kein zuverlässiger Schutz."}]
+    },
+    {
+      "slug": "geteilte-liste", "title": "Fall #6: Die geteilte Liste", "language": "Java", "difficulty": "principal", "examScope": "AP2_FIAE",
+      "description": "Parallele Worker verlieren gelegentlich Aufträge aus ihrer Queue.", "briefing": "Zwei Worker greifen gleichzeitig auf die gemeinsame Auftragsliste zu. Die Ursache liegt nicht dort, wo der Fehler sichtbar wird.", "consoleOutput": "Exception in thread worker-2 java.util.ConcurrentModificationException\n  at java.base/java.util.ArrayList$Itr.next\n  at Worker.run(Worker.java:6)",
+      "files": [
+        {"filename":"Worker.java","content":"public class Worker implements Runnable {\n    private final Auftragsliste liste;\n    public Worker(Auftragsliste liste) { this.liste = liste; }\n    public void run() {\n        for (String job : liste.jobs()) {\n            System.out.println(job);\n        }\n    }\n}"},
+        {"filename":"Auftragsliste.java","content":"import java.util.*;\npublic class Auftragsliste {\n    private final List<String> jobs = new ArrayList<>();\n    public void add(String job) { jobs.add(job); }\n    public List<String> jobs() { return jobs; }\n}"}
+      ],
+      "bugs": [{"points":200,"file":"Auftragsliste.java","line":5,"category":"sicherheit","evidence":"Die interne, veränderbare Liste wird direkt an parallele Aufrufer zurückgegeben.","fixOptions":["    public List<String> jobs() { return List.copyOf(jobs); }","    public List<String> jobs() { return new ArrayList<>(); }","    public List<String> jobs() { return null; }","    public List<String> jobs() { jobs.clear(); return jobs; }"],"fixIndex":0,"fixedLine":"    public List<String> jobs() { return List.copyOf(jobs); }","explanation":"Eine unveränderliche Momentaufnahme verhindert, dass externe Aufrufer die interne Liste gleichzeitig verändern. Für echte gemeinsame Mutation wäre zusätzlich eine threadsichere Datenstruktur nötig."}]
+    }
+  ]
+}

src/main/resources/db/migration/V12__bughunter.sql

@@ -0,0 +1,33 @@
+CREATE TABLE bughunter_hunts (
+    id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+    slug VARCHAR(150) NOT NULL UNIQUE,
+    title VARCHAR(200) NOT NULL,
+    code_language VARCHAR(50) NOT NULL DEFAULT 'Java',
+    difficulty VARCHAR(30) NOT NULL DEFAULT 'junior',
+    exam_scope VARCHAR(20) NOT NULL DEFAULT 'AP1',
+    description VARCHAR(1200),
+    briefing VARCHAR(2000),
+    console_output VARCHAR(4000),
+    sort_order INT NOT NULL DEFAULT 0,
+    active BOOLEAN NOT NULL DEFAULT TRUE,
+    CONSTRAINT chk_bughunter_exam_scope CHECK (exam_scope IN ('AP1','AP2_FIAE','AP2_FISI','CROSS'))
+);
+
+CREATE TABLE bughunter_files (
+    id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+    hunt_id BIGINT NOT NULL REFERENCES bughunter_hunts(id) ON DELETE CASCADE,
+    filename VARCHAR(255) NOT NULL,
+    content VARCHAR(8000) NOT NULL,
+    sort_order INT NOT NULL DEFAULT 0
+);
+
+CREATE TABLE bughunter_bugs (
+    id BIGINT GENERATED BY DEFAULT AS IDENTITY PRIMARY KEY,
+    hunt_id BIGINT NOT NULL REFERENCES bughunter_hunts(id) ON DELETE CASCADE,
+    points INT NOT NULL DEFAULT 100,
+    sort_order INT NOT NULL DEFAULT 0,
+    payload VARCHAR(8000) NOT NULL
+);
+
+CREATE INDEX idx_bughunter_files_hunt ON bughunter_files(hunt_id);
+CREATE INDEX idx_bughunter_bugs_hunt ON bughunter_bugs(hunt_id);

src/main/resources/static/css/theme.css

@@ -126,6 +126,9 @@ a { color:var(--secondary); }
 .mf-card-codeescape { --accent:var(--esc-accent); --glow-s:var(--esc-glow); --glow-w:color-mix(in srgb,var(--esc-accent) 16%,transparent); background:repeating-linear-gradient(0deg,rgba(255,255,255,.015) 0 1px,transparent 1px 4px),var(--surface); }
 .mf-card-codeescape::after { content:"ACCESS"; position:absolute; right:12px; top:9px; color:var(--esc-accent); font:700 .52rem/1 "Courier New",monospace; letter-spacing:.12em; opacity:.6; }
 
+.mf-card-bughunter { --accent:var(--bh-accent); --glow-s:var(--bh-glow); --glow-w:color-mix(in srgb,var(--bh-accent) 16%,transparent); background:linear-gradient(135deg,color-mix(in srgb,var(--bh-accent) 9%,transparent),var(--surface)); }
+.mf-card-bughunter::after { content:"CASE FILE"; position:absolute; right:12px; top:9px; color:var(--bh-accent); font:700 .52rem/1 "Courier New",monospace; letter-spacing:.12em; opacity:.7; }
+
 /* ===== Panels / Widgets ===== */
 .mf-panel { background:var(--surface); border:1px solid var(--border); border-radius:14px; padding:1.1rem; box-shadow:var(--g-soft); }
 .mf-panel.accent { border-color:var(--border-accent); box-shadow:0 0 20px var(--glow-w); }

src/main/resources/static/js/bughunter.js

@@ -0,0 +1,72 @@
+(function () {
+  'use strict';
+  const view = document.getElementById('bhView');
+  let catalog = [], session, index = 0, started = 0, selectedFile = '', selectedLine = 0, selected = '', options = [], answers = [];
+  const esc = value => String(value ?? '').replace(/[&<>"']/g, c => ({'&':'&amp;','<':'&lt;','>':'&gt;','"':'&quot;',"'":'&#39;'}[c]));
+  const api = (url, opt) => fetch('/api/bughunter' + url, {headers:{'Content-Type':'application/json'}, ...opt}).then(async response => { const body = await response.json(); if (!response.ok) throw new Error(body.message || 'Serverfehler'); return body; });
+  const post = (url, body) => api(url, {method:'POST', body:JSON.stringify(body)});
+  const seconds = () => Math.max(1, Math.round((Date.now() - started) / 1000));
+  const current = () => session.bugs[index];
+  const state = () => answers[index];
+  function loadCatalog() { api('/hunts').then(data => { catalog = data.hunts || []; renderCatalog(); }).catch(error); }
+  function renderCatalog() {
+    view.innerHTML = `<section class="bh-hero"><span class="bh-stamp">VERTRAULIC</span><span class="bh-kicker">DETektivbüro · DEBUGGING-FALLAKTEN</span><h1>Welche Spur verfolgst du?</h1><p>Arbeite dich durch echte Fehlerbilder: Ort, Kategorie und Fix müssen zusammenpassen. Präzision baut deine Ermittlungsserie auf.</p></section><section class="bh-grid">${catalog.map(h => `<article class="bh-case"><span class="bh-case-no">${esc(h.examScope)} · ${esc(h.difficulty).toUpperCase()}</span><h2>${esc(h.title)}</h2><p>${esc(h.description)}</p><div class="bh-tags"><span>${esc(h.language)}</span><span>${h.fileCount} Dateien</span><span>${h.bugCount} Bug${h.bugCount === 1 ? '' : 's'}</span></div><button class="bh-btn primary" data-start="${esc(h.slug)}">FALL ÖFFNEN</button></article>`).join('')}</section>`;
+    view.querySelectorAll('[data-start]').forEach(button => button.addEventListener('click', () => begin(button.dataset.start)));
+  }
+  function begin(slug) { api('/session/' + encodeURIComponent(slug)).then(data => { if (!data.found) throw new Error('Fallakte nicht verfügbar.'); session = data; index = 0; answers = session.bugs.map(() => ({locate:null, classify:null, fix:null})); started = Date.now(); renderBriefing(); }).catch(error); }
+  function renderBriefing() {
+    view.innerHTML = `<section class="bh-briefing"><span class="bh-stamp">NEUE AKTE</span><span class="bh-kicker">${esc(session.examScope)} · ${esc(session.difficulty).toUpperCase()} · ${esc(session.language)}</span><h1>${esc(session.title)}</h1><p>${esc(session.briefing)}</p><pre>${esc(session.consoleOutput)}</pre><div class="bh-rules"><div><b>1</b> Ort markieren</div><div><b>2</b> Fehler einordnen</div><div><b>3</b> sauberen Fix wählen</div></div><button class="bh-btn primary" id="bhStart">ERMITTLUNG STARTEN</button></section>`;
+    document.getElementById('bhStart').addEventListener('click', () => { selectedFile = session.files[0]?.filename || ''; selectedLine = 0; selected = ''; options = []; renderHunt(); });
+  }
+  function activePhase() { const s = state(); return !s.locate?.done ? 'locate' : !s.classify?.done ? 'classify' : 'fix'; }
+  function renderHunt() {
+    const bug = current(), s = state(), phase = activePhase();
+    const evidence = bug.evidence || 'Untersuche die Fallakte und folge den Spuren.';
+    view.innerHTML = `<div class="bh-hunt-head"><div><span class="bh-kicker">AKTE ${index + 1} / ${session.bugs.length} · ${esc(session.difficulty).toUpperCase()}</span><h1>${esc(session.title)}</h1></div><div class="bh-combo">${comboText()}<small>saubere Serie</small></div></div><div class="bh-progress">${session.bugs.map((_, i) => `<i class="${i < index ? 'done' : i === index ? 'current' : ''}">${i + 1}</i>`).join('')}</div><div class="bh-layout"><section class="bh-code-area"><div class="bh-tabs">${session.files.map(file => `<button class="${file.filename === selectedFile ? 'active' : ''}" data-file="${esc(file.filename)}">${esc(file.filename)}</button>`).join('')}</div>${renderCode(phase)} </section><aside class="bh-side"><div class="bh-evidence"><span class="bh-stamp">BEWEISSTÜCK</span><p>${esc(evidence)}</p><pre>${esc(session.consoleOutput)}</pre></div>${renderAction(phase, bug, s)}</aside></div>`;
+    view.querySelectorAll('[data-file]').forEach(tab => tab.addEventListener('click', () => { selectedFile = tab.dataset.file; selectedLine = 0; renderHunt(); }));
+    bindAction(phase, bug);
+  }
+  function renderCode(phase) {
+    const file = session.files.find(f => f.filename === selectedFile) || session.files[0];
+    if (!file) return '<p>Keine Datei in der Akte.</p>';
+    return `<div class="bh-code" aria-label="Code-Datei ${esc(file.filename)}">${file.lines.map((line, i) => { const lineNo = i + 1, marked = phase === 'locate' && selectedLine === lineNo; return `<button class="bh-line ${marked ? 'selected' : ''}" data-line="${lineNo}" ${phase === 'locate' ? '' : 'disabled'}><span>${lineNo}</span><code>${esc(line) || ' '}</code></button>`; }).join('')}</div>`;
+  }
+  function renderAction(phase, bug, s) {
+    const labels = {locate:'1 · ORTEN', classify:'2 · KLASSIFIZIEREN', fix:'3 · FIXEN'};
+    let content = '';
+    if (phase === 'locate') content = `<p>Klicke die fehlerhafte Zeile im Code an.</p><p class="bh-selected">${selectedLine ? `${esc(selectedFile)}:${selectedLine}` : 'Noch keine Zeile markiert'}</p>`;
+    if (phase === 'classify') content = `<p>Welche Fehlerklasse erklärt den Fund am besten?</p><div class="bh-options">${[['syntax','Syntax'],['logik','Logik'],['laufzeit','Laufzeit'],['sicherheit','Sicherheit']].map(([value,label]) => `<button data-choice="${value}" class="${selected === value ? 'selected' : ''}">${label}</button>`).join('')}</div>`;
+    if (phase === 'fix') content = `<p>Wähle die Zeile, die den Fehler sauber behebt.</p><div class="bh-options">${options.map(value => `<button data-choice="${esc(value)}" class="${selected === value ? 'selected' : ''}"><code>${esc(value)}</code></button>`).join('')}</div>`;
+    const attempts = s[phase]?.attempts || 0;
+    return `<section class="bh-action"><span class="bh-kicker">${labels[phase]}</span><h2>${phase === 'locate' ? 'Wo liegt der Bug?' : phase === 'classify' ? 'Wie heißt das Problem?' : 'Wie wird er behoben?'}</h2>${content}<p class="bh-attempts">Versuche: ${attempts}/3</p><div id="bhFeedback" class="bh-feedback" aria-live="polite"></div><div class="bh-actions"><button class="bh-btn primary" id="bhCheck">PRÜFEN</button><button class="bh-btn" id="bhReveal">AUFLÖSEN</button></div></section>`;
+  }
+  function bindAction(phase, bug) {
+    if (phase === 'locate') view.querySelectorAll('[data-line]').forEach(line => line.addEventListener('click', () => { selectedLine = Number(line.dataset.line); renderHunt(); }));
+    view.querySelectorAll('[data-choice]').forEach(button => button.addEventListener('click', () => { selected = button.dataset.choice; view.querySelectorAll('[data-choice]').forEach(item => item.classList.remove('selected')); button.classList.add('selected'); }));
+    document.getElementById('bhCheck').addEventListener('click', () => submit(phase, bug, false));
+    document.getElementById('bhReveal').addEventListener('click', () => submit(phase, bug, true));
+  }
+  function submission(phase) { return phase === 'locate' ? {file:selectedFile, line:selectedLine} : phase === 'classify' ? {category:selected} : {choice:selected}; }
+  function submit(phase, bug, reveal) {
+    const sub = submission(phase); if (!reveal && ((phase === 'locate' && !sub.line) || (phase !== 'locate' && !selected))) { feedback('Triff zuerst eine Auswahl.', 'bad'); return; }
+    const phaseState = state()[phase] || {attempts:0}; phaseState.attempts = Math.min(3, phaseState.attempts + 1); phaseState.submission = sub;
+    post('/check', {bugId:bug.bugId, phase, reveal, submission:sub}).then(result => {
+      if (!result.resolved) { state()[phase] = phaseState; feedback('Noch nicht stimmig. Lies die Beweise erneut.', 'bad'); return; }
+      phaseState.revealed = reveal; phaseState.done = true; state()[phase] = phaseState;
+      if (phase === 'classify') options = result.fixOptions || []; if (phase === 'fix') { showDebrief(result); return; }
+      selected = ''; if (phase === 'locate') selectedLine = result.location?.line || selectedLine;
+      feedback(reveal ? 'Auflösung notiert – weiter zur nächsten Phase.' : 'Spur bestätigt – weiter zur nächsten Phase.', 'ok'); setTimeout(renderHunt, 650);
+    }).catch(err => feedback(err.message, 'bad'));
+  }
+  function showDebrief(result) {
+    const bug = current(); view.innerHTML = `<section class="bh-debrief"><span class="bh-stamp">GELÖST</span><span class="bh-kicker">AKTE ${index + 1} ABGESCHLOSSEN</span><h1>Die Spur ist gesichert.</h1><p>${esc(result.explanation || 'Die Fallakte wurde aktualisiert.')}</p><div class="bh-diff"><span>− fehlerhafte Zeile</span><code>${esc(selectedFile)}:${state().locate?.submission?.line || '?'}</code><span>+ Korrektur</span><code>${esc(result.fixedLine || '')}</code></div><button class="bh-btn primary" id="bhNext">${index + 1 < session.bugs.length ? 'NÄCHSTE AKTE' : 'ERGEBNIS AUSWERTEN'}</button></section>`;
+    document.getElementById('bhNext').addEventListener('click', () => { index++; selected = ''; selectedLine = 0; options = []; if (index >= session.bugs.length) finish(); else { selectedFile = session.files[0]?.filename || ''; renderHunt(); } });
+  }
+  function finish() { post('/finish', {slug:session.slug, durationSeconds:seconds(), items:answers.map((answer, i) => ({bugId:session.bugs[i].bugId, locate:strip(answer.locate), classify:strip(answer.classify), fix:strip(answer.fix)}))}).then(renderResult).catch(error); }
+  function strip(value) { return value ? {submission:value.submission, attempts:value.attempts, revealed:!!value.revealed} : null; }
+  function comboText() { let combo = 0; for (let i = 0; i < index; i++) { const a = answers[i]; const clean = ['locate','classify','fix'].every(key => a[key] && a[key].attempts === 1 && !a[key].revealed); combo = clean ? combo + 1 : 0; } return `×${combo}`; }
+  function renderResult(result) { view.innerHTML = `<section class="bh-result"><span class="bh-stamp">ERMITTLUNG ABGESCHLOSSEN</span><h1>Fallakten geschlossen.</h1><div class="bh-score">${result.score}</div><p class="bh-stars">${'★'.repeat(result.stars)}${'☆'.repeat(3-result.stars)}</p><div class="bh-stats"><div><b>${result.baseScore}</b>Basis</div><div><b>+${result.comboBonus}</b>Combo</div><div><b>${result.bugsSolved}/${result.totalBugs}</b>gelöst</div><div><b>×${result.maxCombo}</b>Serie</div><div><b>${result.highscore}</b>Highscore</div><div><b>${result.plays}</b>Akten</div></div><button class="bh-btn primary" id="bhAgain">WEITERE FÄLLE</button></section>`; document.getElementById('bhAgain').addEventListener('click', loadCatalog); }
+  function feedback(message, type) { const target = document.getElementById('bhFeedback'); if (target) { target.textContent = message; target.className = 'bh-feedback ' + type; } }
+  function error(err) { view.innerHTML = `<section class="bh-result"><h1>AKTE NICHT LESBAR</h1><p>${esc(err.message || err)}</p><button class="bh-btn" id="bhReload">ERNEUT VERSUCHEN</button></section>`; document.getElementById('bhReload').addEventListener('click', loadCatalog); }
+  loadCatalog();
+})();

src/main/resources/templates/admin/bughunter-hunt.html

@@ -0,0 +1 @@
+<!doctype html><html lang="de" data-theme="dark" xmlns:th="http://www.thymeleaf.org"><head><meta charset="utf-8"><title>BugHunter Fallakte</title><link rel="stylesheet" href="/css/theme.css"><script src="/js/theme.js"></script></head><body><main class="mf-container" th:if="${hunt != null}"><a class="mf-back" href="/admin/bughunter">← Fallakten</a><h1 th:text="${hunt.title}" style="margin:1rem 0;color:var(--heading)"></h1><div class="mf-grid"><form class="mf-panel" method="post" th:action="@{/admin/bughunter/{id}/files(id=${hunt.id})}"><h2>Datei hinzufügen</h2><div class="mf-field"><label class="mf-label">Dateiname</label><input class="mf-input" name="filename" required></div><div class="mf-field"><label class="mf-label">Code</label><textarea class="mf-input" rows="14" name="content" required></textarea></div><button class="mf-btn">Datei speichern</button></form><form class="mf-panel" method="post" th:action="@{/admin/bughunter/{id}/bugs(id=${hunt.id})}"><h2>Bug hinzufügen</h2><div class="mf-field"><label class="mf-label">Punkte</label><input class="mf-input" type="number" name="points" value="100"></div><div class="mf-field"><label class="mf-label">Payload JSON</label><textarea class="mf-input" rows="14" name="payload" required>{"file":"Datei.java","line":1,"category":"logik","evidence":"...","fixOptions":["..."],"fixIndex":0,"fixedLine":"...","explanation":"..."}</textarea></div><p style="color:var(--muted);font-size:.85rem">Dateiname und Zeile müssen zu einer vorhandenen Datei passen; Kategorie: syntax, logik, laufzeit oder sicherheit.</p><button class="mf-btn">Bug speichern</button></form></div><section class="mf-panel" style="margin-top:1rem"><h2>Dateien</h2><table class="mf-table"><tr><th>Datei</th><th>Zeilen</th><th></th></tr><tr th:each="f:${hunt.files}"><td th:text="${f.filename}"></td><td th:text="${#strings.arrayLength(#strings.arraySplit(f.content, '\n'))}"></td><td><form method="post" th:action="@{/admin/bughunter/files/{id}/delete(id=${f.id})}"><input type="hidden" name="huntId" th:value="${hunt.id}"><button class="mf-btn danger">Löschen</button></form></td></tr></table></section><section class="mf-panel" style="margin-top:1rem"><h2>Bugs</h2><table class="mf-table"><tr><th>Punkte</th><th>Payload</th><th></th></tr><tr th:each="b:${hunt.bugs}"><td th:text="${b.points}"></td><td><code th:text="${b.payload}"></code></td><td><form method="post" th:action="@{/admin/bughunter/bugs/{id}/delete(id=${b.id})}"><input type="hidden" name="huntId" th:value="${hunt.id}"><button class="mf-btn danger">Löschen</button></form></td></tr></table></section></main><main class="mf-container" th:unless="${hunt != null}"><p>Fallakte nicht gefunden.</p></main></body></html>

src/main/resources/templates/admin/bughunter.html

@@ -0,0 +1 @@
+<!doctype html><html lang="de" data-theme="dark" xmlns:th="http://www.thymeleaf.org"><head><meta charset="utf-8"><title>Admin · BugHunter</title><link rel="stylesheet" href="/css/theme.css"><script src="/js/theme.js"></script></head><body><main class="mf-container"><a class="mf-back" href="/admin">← Admin</a><h1 style="margin:1rem 0;color:var(--heading)">BugHunter · Fallakten</h1><form class="mf-panel" method="post" action="/admin/bughunter/add"><div class="mf-field"><label class="mf-label">Titel</label><input class="mf-input" name="title" required></div><div class="mf-field"><label class="mf-label">Code-Sprache</label><input class="mf-input" name="language" value="Java"></div><div class="mf-field"><label class="mf-label">Stufe</label><select class="mf-select" name="difficulty"><option>junior</option><option>senior</option><option>principal</option></select></div><div class="mf-field"><label class="mf-label">Prüfungsbereich</label><select class="mf-select" name="examScope"><option>AP1</option><option>AP2_FIAE</option><option>AP2_FISI</option><option>CROSS</option></select></div><div class="mf-field"><label class="mf-label">Kurzbeschreibung</label><textarea class="mf-input" name="description"></textarea></div><div class="mf-field"><label class="mf-label">Briefing</label><textarea class="mf-input" name="briefing"></textarea></div><div class="mf-field"><label class="mf-label">Konsolen-Ausgabe</label><textarea class="mf-input" name="consoleOutput"></textarea></div><button class="mf-btn">Fallakte anlegen</button></form><table class="mf-table" style="margin-top:1rem"><tr><th>Titel</th><th>Stufe</th><th>Scope</th><th>Fälle</th><th>Status</th><th></th></tr><tr th:each="h:${hunts}"><td><a th:href="@{/admin/bughunter/{id}(id=${h.id})}" th:text="${h.title}"></a></td><td th:text="${h.difficulty}"></td><td th:text="${h.examScope}"></td><td th:text="${h.bugs.size}"></td><td th:text="${h.active?'aktiv':'inaktiv'}"></td><td><form style="display:inline" method="post" th:action="@{/admin/bughunter/{id}/toggle(id=${h.id})}"><button class="mf-btn outline">Toggle</button></form> <form style="display:inline" method="post" th:action="@{/admin/bughunter/{id}/delete(id=${h.id})}"><button class="mf-btn danger">Löschen</button></form></td></tr></table></main></body></html>

src/main/resources/templates/admin/dashboard.html

@@ -49,6 +49,7 @@
         <a th:href="@{/admin/syntaxsaga}" class="admin-card">📜 Syntax-Saga-Missionen verwalten</a>
         <a th:href="@{/admin/devlab}" class="admin-card">⚗️ Dev-Lab-Aufgaben verwalten</a>
         <a th:href="@{/admin/codeescape}" class="admin-card">🚪 SystemEscape-Szenarien verwalten</a>
+        <a th:href="@{/admin/bughunter}" class="admin-card">🕵️ BugHunter-Fallakten verwalten</a>
       </div>
       <p style="margin-top:1.1rem; color:var(--muted);">
         Hier entsteht noch Großes... ✨ Bleib dran!

src/main/resources/templates/bughunter.html

@@ -0,0 +1 @@
+<!doctype html><html lang="de" data-theme="dark"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>BugHunter · Mindflux</title><link rel="stylesheet" href="/css/theme.css"><link rel="stylesheet" href="/css/bughunter.css?v=1"><script src="/js/theme.js"></script></head><body><main class="bh-app"><header class="bh-top"><a href="/dashboard" class="bh-back">← Dashboard</a><div class="bh-brand"><b>BUGHUNTER</b><span>INVESTIGATION BUREAU</span></div><span class="mf-a11y-host"></span></header><section id="bhView" class="bh-view"><div class="bh-loading">FALLAKTEN WERDEN GEÖFFNET …</div></section></main><script src="/js/bughunter.js?v=1"></script></body></html>

src/main/resources/templates/dashboard.html

@@ -137,12 +137,12 @@
     ['SyntaxSaga','terminal','Interaktive IT-Geschichten mit Lückentexten – wie ein Textadventure zum Mitdenken.','/syntaxsaga'],
     ['SystemEscape','lock','Löse IT-Rätsel, sammle Zugriffsfragmente und entkomme dem System.','/codeescape'],
     ['ServiceClash','sword','Der chaotische Admin-Alltag als Spiel – meistere Anfragen & halte Systeme am Laufen!','/comingsoon'],
-    ['BugHunter','bug','Finde Fehler im Code, denke wie ein Debugger und löse knifflige Bugs.','/comingsoon'],
+    ['BugHunter','bug','Finde Fehler im Code, denke wie ein Debugger und löse knifflige Bugs.','/bughunter'],
     ['NetWorker','network','Verbinde Netzwerke, konfiguriere IPs und löse Routing-Herausforderungen.','/comingsoon'],
     ['FinalFlux','trophy','Dein Power-Modul für die Prüfung – gezielt lernen, strukturiert trainieren, sicher bestehen.','/finalflux']
   ];
   document.getElementById('grid').innerHTML = GAMES.map(([t,ic,d,href])=>`
-    <a class="mf-card ${t === 'SystemEscape' ? 'mf-card-codeescape' : ''}" href="${href}">
+    <a class="mf-card ${t === 'SystemEscape' ? 'mf-card-codeescape' : ''} ${t === 'BugHunter' ? 'mf-card-bughunter' : ''}" href="${href}">
       <span class="ico"><svg viewBox="0 0 64 64" fill="none" stroke="currentColor" stroke-width="2.4" stroke-linecap="round" stroke-linejoin="round">${GI[ic]}</svg></span>
       <h3>${t}</h3><p>${d}</p>
       <span class="mf-play">SPIEL STARTEN <svg viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2.5"><path d="M5 12h14M13 6l6 6-6 6"/></svg></span>