Add test and security baseline

- make quick/check/mutation from cj/security-baseline (Makefile unchanged,
  settings in baseline.mk), pre-commit, gitleaks, Semgrep rules, ESLint
  security rules, Forgejo workflow
- tests/security: generic baseline tests plus app config and role tests
  against createApp() with an in-memory database
- extract createApp() from src/server/index.ts; LB_DATABASE_PATH for tests
- fix gaps found by the tests: reject unknown fields on project create,
  answer malformed JSON with 400 instead of 500, set nosniff on the API
- npm audit fix (next 16.4.1 and others, no high/critical left)
- clear ESLint errors, safeFileName without control-character regex
- per-project ownership stays an open, documented gap (idorGap -> TODO)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.forgejo/workflows/security.yml

@@ -0,0 +1,57 @@
+# Forgejo Actions: Baseline-Pipeline bei jedem Push.
+# Ziel in der App: .forgejo/workflows/security.yml
+# Voraussetzung: Forgejo-Runner mit Label "docker" und Zugriff auf Docker (für gitleaks/Semgrep/Trivy
+# laufen die Jobs in Containern). Runner möglichst isoliert betreiben, nicht mit Host-Docker-Socket
+# auf dem Produktionshost.
+# UNGEPRÜFT: ob git.jappel.io einen Runner mit Label "docker" hat, war beim Einbau unbekannt.
+# Beim ersten Lauf Logs ansehen und nachziehen.
+name: security-baseline
+
+on:
+  push:
+  pull_request:
+
+jobs:
+  secrets:
+    runs-on: docker
+    container: ghcr.io/gitleaks/gitleaks:v8.30.1
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - run: gitleaks git . --redact --no-banner $( [ -f .gitleaks.toml ] && echo "-c .gitleaks.toml" )
+
+  node:
+    runs-on: docker
+    container: node:24
+    env:
+      NODE_DIR: .
+    steps:
+      - uses: actions/checkout@v4
+      - name: Prüfen, ob es ein Node-Projekt gibt
+        id: has
+        run: if [ -f "$NODE_DIR/package.json" ]; then echo "node=1" >> "$GITHUB_OUTPUT"; fi
+      - if: steps.has.outputs.node
+        working-directory: ${{ env.NODE_DIR }}
+        run: |
+          npm ci --no-audit --no-fund
+          npm run lint --if-present
+          npm run typecheck --if-present
+          # tests/circuit-tree.controller.test.ts liest die Standard-Datenbank data/leistungsbilanz.db.
+          node scripts/run-migrations.js
+          npm test
+          npm audit --audit-level=high
+
+  semgrep:
+    runs-on: docker
+    container: semgrep/semgrep:1.179.0
+    steps:
+      - uses: actions/checkout@v4
+      - run: semgrep scan --config .semgrep --error --metrics=off
+
+  trivy:
+    runs-on: docker
+    container: aquasec/trivy:latest
+    steps:
+      - uses: actions/checkout@v4
+      - run: trivy fs --scanners vuln,misconfig,secret --severity HIGH,CRITICAL --exit-code 1 .