Fix monthly PDF export to include only the selected month

The month dropdown carried only the month (e.g. "07") while the year was
a separate select; the export required month AND year, so a month-only
selection fell through to exporting every application. Encode the year in
the month option value ("YYYY-MM"), parse it client-side to always send
the exact month+year, and harden /api/export so a month can never fall
through to "export all".

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server.js

@@ -849,6 +849,11 @@ initializeDatabase().then(() => {
       if (month && year) {
         query = 'SELECT * FROM bewerbungen WHERE strftime("%m", datum) = ? AND strftime("%Y", datum) = ? ORDER BY datum DESC';
         params.push(month.padStart(2, '0'), year);
+      } else if (month) {
+        // A month without a year must still restrict the export to that month —
+        // never fall through to exporting every application.
+        query = 'SELECT * FROM bewerbungen WHERE strftime("%m", datum) = ? ORDER BY datum DESC';
+        params.push(month.padStart(2, '0'));
       } else if (year) {
         query = 'SELECT * FROM bewerbungen WHERE strftime("%Y", datum) = ? ORDER BY datum DESC';
         params.push(year);