Future appointment decryption via recipient key insertion

Missing authorization in OpenReception before 1.0.4 allows remote attackers to decrypt future appointment data via injected recipient keys. The staff crypto POST handler logs unauthenticated requests but continues storing attacker-controlled ML-KEM keys, while an omitted email makes two undefined values compare equal and suppresses the warning. Network reachability and a known or guessable tenant domain are sufficient; later bookings encrypt tunnel keys to the injected recipient, exposing their payloads and allowing malformed keys to interrupt booking.