Add test and security baseline

- make quick/check/mutation from cj/security-baseline (Makefile unchanged,
  settings in baseline.mk), pre-commit, gitleaks, Semgrep rules, ESLint
  security rules, Forgejo workflow
- tests/security: generic baseline tests plus app config and role tests
  against createApp() with an in-memory database
- extract createApp() from src/server/index.ts; LB_DATABASE_PATH for tests
- fix gaps found by the tests: reject unknown fields on project create,
  answer malformed JSON with 400 instead of 500, set nosniff on the API
- npm audit fix (next 16.4.1 and others, no high/critical left)
- clear ESLint errors, safeFileName without control-character regex
- per-project ownership stays an open, documented gap (idorGap -> TODO)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/fixtures/revit-csv-fixtures.ts

@@ -27,7 +27,7 @@ export const quotedRevitCsv = [
   `"UV_AV_01-2F1";"01/101";"Technik";"Steckdose: Doppelsteckdose";"Arbeitsplatz";"120,5";"2";"${firstIfcGuid}"`,
   '"UV_AV_01-2F1: 2";"";"";"";"";"";"";""',
   '"";"01/102";"Büro";"Steckdose: Standard";"Arbeitsplatz";"100";"1";""',
-  `"";"01/103";"Büro \"\"Nord\"\"";"Steckdose: Standard";"Arbeitsplatz";"100";"1";"${secondIfcGuid}"`,
+  `"";"01/103";"Büro ""Nord""";"Steckdose: Standard";"Arbeitsplatz";"100";"1";"${secondIfcGuid}"`,
 ].join("\r\n") + "\r\n";
 
 export function utf8Bytes(value: string, withBom = false) {