Add test and security baseline

- make quick/check/mutation from cj/security-baseline (Makefile unchanged,
  settings in baseline.mk), pre-commit, gitleaks, Semgrep rules, ESLint
  security rules, Forgejo workflow
- tests/security: generic baseline tests plus app config and role tests
  against createApp() with an in-memory database
- extract createApp() from src/server/index.ts; LB_DATABASE_PATH for tests
- fix gaps found by the tests: reject unknown fields on project create,
  answer malformed JSON with 400 instead of 500, set nosniff on the API
- npm audit fix (next 16.4.1 and others, no high/critical left)
- clear ESLint errors, safeFileName without control-character regex
- per-project ownership stays an open, documented gap (idorGap -> TODO)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/frontend/print/print-document.tsx

@@ -53,7 +53,7 @@ function Open() {
 
 function Logo({ src, className }: { src: string | null; className: string }) {
   return src ? (
-    // eslint-disable-next-line @next/next/no-img-element
+    // Plain <img> on purpose: the print document renders the stored logo as-is.
     <img alt="Logo" className={`pd-logo ${className}`} src={src} />
   ) : (
     <span className={`pd-logo-missing ${className}`}>Logo</span>