Add test and security baseline

- make quick/check/mutation from cj/security-baseline (Makefile unchanged,
  settings in baseline.mk), pre-commit, gitleaks, Semgrep rules, ESLint
  security rules, Forgejo workflow
- tests/security: generic baseline tests plus app config and role tests
  against createApp() with an in-memory database
- extract createApp() from src/server/index.ts; LB_DATABASE_PATH for tests
- fix gaps found by the tests: reject unknown fields on project create,
  answer malformed JSON with 400 instead of 500, set nosniff on the API
- npm audit fix (next 16.4.1 and others, no high/critical left)
- clear ESLint errors, safeFileName without control-character regex
- per-project ownership stays an open, documented gap (idorGap -> TODO)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

.pre-commit-config.yaml

@@ -0,0 +1,31 @@
+# Pre-Commit der Baseline: Secrets und offensichtlicher Mist kommen gar nicht erst ins Repo.
+# Einrichten: make setup (installiert den Hook). Manuell über alles: .venv-tools/bin/pre-commit run -a
+
+repos:
+  - repo: https://github.com/gitleaks/gitleaks
+    rev: v8.30.1
+    hooks:
+      - id: gitleaks
+
+  - repo: https://github.com/pre-commit/pre-commit-hooks
+    rev: v6.0.0
+    hooks:
+      - id: check-added-large-files
+        args: ["--maxkb=1024"]
+      - id: check-merge-conflict
+      - id: check-yaml
+      - id: check-toml
+      - id: check-json
+        exclude: (^|/)tsconfig.*\.json$
+      - id: detect-private-key
+      - id: end-of-file-fixer
+      - id: trailing-whitespace
+
+  - repo: local
+    hooks:
+      - id: no-env-files
+        name: keine .env-Dateien committen (nur .env.example)
+        entry: ".env-Dateien gehören nicht ins Repo. Secrets in den Secret-Store, Vorlage als .env.example"
+        language: fail
+        files: (^|/)\.env(\.[^/]*)?$
+        exclude: \.env\.example$