Add test and security baseline

- make quick/check/mutation from cj/security-baseline (Makefile unchanged,
  settings in baseline.mk), pre-commit, gitleaks, Semgrep rules, ESLint
  security rules, Forgejo workflow
- tests/security: generic baseline tests plus app config and role tests
  against createApp() with an in-memory database
- extract createApp() from src/server/index.ts; LB_DATABASE_PATH for tests
- fix gaps found by the tests: reject unknown fields on project create,
  answer malformed JSON with 400 instead of 500, set nosniff on the API
- npm audit fix (next 16.4.1 and others, no high/critical left)
- clear ESLint errors, safeFileName without control-character regex
- per-project ownership stays an open, documented gap (idorGap -> TODO)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/distribution-board-feeder-circuit.test.ts

@@ -111,7 +111,17 @@ describe("distribution-board feeder circuit planning", () => {
       sectionId: "three",
       displayName: "",
     });
-    const requests: Array<{ url: string; method: string; body: any }> = [];
+    type FeederCommandBody = {
+      expectedRevision: number;
+      command: {
+        type: string;
+        payload: {
+          circuit: { id: string };
+          boardUpdate: { payload: { changes: Array<{ field: string; value: unknown }> } };
+        };
+      };
+    };
+    const requests: Array<{ url: string; method: string; body: FeederCommandBody }> = [];
     const originalFetch = globalThis.fetch;
     globalThis.fetch = async (request, init) => {
       requests.push({