fix sonarqube findings

public/js/editor-ui.js

@@ -766,11 +766,14 @@ globalThis.Wegwichtel = globalThis.Wegwichtel || {};
   }
 
   function safeGpxFilename(name) {
-    const base = text(name || 'wegwichtel-route')
+    let base = text(name || 'wegwichtel-route')
       .normalize('NFKD')
-      .replaceAll(/[^a-zA-Z0-9_-]+/g, '-')
-      .replaceAll(/^-+|-+$/g, '')
-      .slice(0, 80);
+      .replaceAll(/[^a-zA-Z0-9_-]+/g, '-');
+
+    while (base.startsWith('-')) base = base.slice(1);
+    while (base.endsWith('-')) base = base.slice(0, -1);
+
+    base = base.slice(0, 80);
     return `${base || 'wegwichtel-route'}.gpx`;
   }
 
@@ -822,17 +825,18 @@ globalThis.Wegwichtel = globalThis.Wegwichtel || {};
       const orderedPois = [...(routePackage.pois || [])]
         .sort((left, right) => Number(left.sequence) - Number(right.sequence));
       for (const [index, poi] of orderedPois.entries()) {
+        const poiTitle = poi.title || `Station ${index + 1}`;
         const poiPayload = await sendJson(`/routes/${encodeURIComponent(createdRouteId)}/pois`, 'POST', {
           description: poi.description || '',
           lat: poi.lat,
           lon: poi.lon,
           sequence: index,
-          title: poi.title || `Station ${index + 1}`,
+          title: poiTitle,
           triggerRadiusM: poi.triggerRadiusM || 25
         });
         const serverPoi = poiPayload.poi || poiPayload;
         const serverPoiId = poiId(serverPoi);
-        if (!serverPoiId) throw new Error(`Für ${poi.title || `Station ${index + 1}`} wurde keine Server-POI-ID zurückgegeben.`);
+        if (!serverPoiId) throw new Error(`Für ${poiTitle} wurde keine Server-POI-ID zurückgegeben.`);
         await uploadLocalPoiMedia(createdRouteId, serverPoiId, poi);
       }
       return createdRouteId;