Add test and security baseline

- make quick/check/mutation from cj/security-baseline (Makefile unchanged,
  settings in baseline.mk), pre-commit, gitleaks, Semgrep rules, ESLint
  security rules, Forgejo workflow
- tests/security: generic baseline tests plus app config and role tests
  against createApp() with an in-memory database
- extract createApp() from src/server/index.ts; LB_DATABASE_PATH for tests
- fix gaps found by the tests: reject unknown fields on project create,
  answer malformed JSON with 400 instead of 500, set nosniff on the API
- npm audit fix (next 16.4.1 and others, no high/critical left)
- clear ESLint errors, safeFileName without control-character regex
- per-project ownership stays an open, documented gap (idorGap -> TODO)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

src/db/repositories/circuit-group-renumber-project-command.repository.ts

@@ -14,6 +14,10 @@ import { circuits } from "../schema/circuits.js";
 import { distributionBoardComponents } from "../schema/distribution-board-components.js";
 import { executeProjectCommandTransaction } from "./project-command-transaction.persistence.js";
 
+function temporaryIdentifierKey(table: "circuit" | "component", id: string): string {
+  return `${table}:${id}`;
+}
+
 export class CircuitGroupRenumberProjectCommandRepository
   implements CircuitGroupRenumberProjectCommandStore
 {
@@ -69,7 +73,7 @@ export class CircuitGroupRenumberProjectCommandRepository
           table: "component" as const,
         })),
       ]) {
-        const key = `${assignment.table}:${assignment.id}`;
+        const key = temporaryIdentifierKey(assignment.table, assignment.id);
         const temporary = createTemporaryIdentifier(
           key,
           occupiedIdentifiers
@@ -145,7 +149,7 @@ export class CircuitGroupRenumberProjectCommandRepository
           "circuit",
           assignment.circuitId,
           circuitListId,
-          temporaryIdentifiers.get(`circuit:${assignment.circuitId}`)!,
+          temporaryIdentifiers.get(temporaryIdentifierKey("circuit", assignment.circuitId))!,
           assignment.targetEquipmentIdentifier
         );
       }
@@ -155,7 +159,7 @@ export class CircuitGroupRenumberProjectCommandRepository
           "component",
           assignment.componentId,
           circuitListId,
-          temporaryIdentifiers.get(`component:${assignment.componentId}`)!,
+          temporaryIdentifiers.get(temporaryIdentifierKey("component", assignment.componentId))!,
           assignment.targetEquipmentIdentifier
         );
       }

src/db/repositories/distribution-board-structure-project-command.repository.ts

@@ -1,8 +1,6 @@
 import { and, asc, eq, inArray } from "drizzle-orm";
 import { isDeepStrictEqual } from "node:util";
 import {
-  assertDistributionBoardDeleteProjectCommand,
-  assertDistributionBoardInsertProjectCommand,
   distributionBoardDeleteCommandType,
   distributionBoardInsertCommandType,
   invertDistributionBoardStructureProjectCommand,

src/db/repositories/external-initial-import-project-command.repository.ts

@@ -17,7 +17,6 @@ import { externalModelObjects } from "../schema/external-model-objects.js";
 import { externalModelSources } from "../schema/external-model-sources.js";
 import { externalRoomMappings } from "../schema/external-room-mappings.js";
 import { projectDevices } from "../schema/project-devices.js";
-import { projects } from "../schema/projects.js";
 import { rooms } from "../schema/rooms.js";
 import { executeProjectCommandTransaction } from "./project-command-transaction.persistence.js";
 import { ExternalModelStateRepository } from "./external-model-state.repository.js";

src/db/repositories/external-object-new-circuit-project-command.repository.ts

@@ -7,7 +7,6 @@ import {
   invertExternalObjectNewCircuitProjectCommand,
   type ExternalObjectNewCircuitProjectCommand,
 } from "../../domain/models/external-object-new-circuit-project-command.model.js";
-import type { CircuitDeviceRowSnapshot } from "../../domain/models/circuit-device-row-structure-project-command.model.js";
 import type { CircuitSnapshot } from "../../domain/models/circuit-structure-project-command.model.js";
 import type { ExternalObjectNewCircuitProjectCommandStore } from "../../domain/ports/external-object-new-circuit-project-command.store.js";
 import { parseGroupedEquipmentIdentifier } from "../../domain/services/circuit-group-numbering.js";