Add test and security baseline

- make quick/check/mutation from cj/security-baseline (Makefile unchanged,
  settings in baseline.mk), pre-commit, gitleaks, Semgrep rules, ESLint
  security rules, Forgejo workflow
- tests/security: generic baseline tests plus app config and role tests
  against createApp() with an in-memory database
- extract createApp() from src/server/index.ts; LB_DATABASE_PATH for tests
- fix gaps found by the tests: reject unknown fields on project create,
  answer malformed JSON with 400 instead of 500, set nosniff on the API
- npm audit fix (next 16.4.1 and others, no high/critical left)
- clear ESLint errors, safeFileName without control-character regex
- per-project ownership stays an open, documented gap (idorGap -> TODO)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

package.json

@@ -27,7 +27,9 @@
     "db:migrate": "node scripts/run-migrations.js",
     "db:backup": "tsx scripts/db-backup.ts",
     "db:verify:circuit-schema": "node scripts/db-verify-circuit-schema.js",
-    "revit:verify-reference": "tsx scripts/verify-revit-reference-xlsx.ts"
+    "revit:verify-reference": "tsx scripts/verify-revit-reference-xlsx.ts",
+    "lint": "eslint .",
+    "typecheck": "tsc --noEmit -p tsconfig.json && tsc --noEmit -p tsconfig.next.json && tsc --noEmit -p tsconfig.scripts.json"
   },
   "keywords": [],
   "author": "",
@@ -45,13 +47,21 @@
     "zod": "^4.4.1"
   },
   "devDependencies": {
+    "@eslint/js": "9.39.5",
     "@types/better-sqlite3": "^7.6.13",
     "@types/express": "^5.0.6",
     "@types/node": "^24.10.1",
     "@types/react": "^19.2.14",
     "@types/react-dom": "^19.2.3",
     "drizzle-kit": "^0.31.10",
+    "eslint": "9.39.5",
+    "eslint-plugin-no-unsanitized": "4.1.5",
+    "eslint-plugin-react": "7.37.5",
+    "eslint-plugin-react-hooks": "7.1.1",
+    "eslint-plugin-security": "4.2.0",
+    "globals": "17.13.0",
     "tsx": "^4.21.0",
-    "typescript": "^6.0.3"
+    "typescript": "^6.0.3",
+    "typescript-eslint": "8.71.2"
   }
 }