Add test and security baseline

- make quick/check/mutation from cj/security-baseline (Makefile unchanged,
  settings in baseline.mk), pre-commit, gitleaks, Semgrep rules, ESLint
  security rules, Forgejo workflow
- tests/security: generic baseline tests plus app config and role tests
  against createApp() with an in-memory database
- extract createApp() from src/server/index.ts; LB_DATABASE_PATH for tests
- fix gaps found by the tests: reject unknown fields on project create,
  answer malformed JSON with 400 instead of 500, set nosniff on the API
- npm audit fix (next 16.4.1 and others, no high/critical left)
- clear ESLint errors, safeFileName without control-character regex
- per-project ownership stays an open, documented gap (idorGap -> TODO)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

scripts/run-tests.mjs

@@ -2,11 +2,14 @@ import { readdirSync } from "node:fs";
 import { spawnSync } from "node:child_process";
 import path from "node:path";
 
-const testFiles = readdirSync(path.resolve("tests"), {
-  withFileTypes: true,
-})
-  .filter((entry) => entry.isFile() && entry.name.endsWith(".test.ts"))
-  .map((entry) => path.join("tests", entry.name))
+// tests/*.test.ts plus die Sicherheits-Baseline unter tests/security/.
+const testDirectories = ["tests", path.join("tests", "security")];
+const testFiles = testDirectories
+  .flatMap((directory) =>
+    readdirSync(path.resolve(directory), { withFileTypes: true })
+      .filter((entry) => entry.isFile() && entry.name.endsWith(".test.ts"))
+      .map((entry) => path.join(directory, entry.name))
+  )
   .sort();
 
 if (testFiles.length === 0) {