Add test and security baseline

- make quick/check/mutation from cj/security-baseline (Makefile unchanged,
  settings in baseline.mk), pre-commit, gitleaks, Semgrep rules, ESLint
  security rules, Forgejo workflow
- tests/security: generic baseline tests plus app config and role tests
  against createApp() with an in-memory database
- extract createApp() from src/server/index.ts; LB_DATABASE_PATH for tests
- fix gaps found by the tests: reject unknown fields on project create,
  answer malformed JSON with 400 instead of 500, set nosniff on the API
- npm audit fix (next 16.4.1 and others, no high/critical left)
- clear ESLint errors, safeFileName without control-character regex
- per-project ownership stays an open, documented gap (idorGap -> TODO)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/safe-file-name.test.ts

@@ -0,0 +1,21 @@
+import assert from "node:assert/strict";
+import { describe, it } from "node:test";
+import { safeFileName } from "../src/server/controllers/external-return-workbook.controller.js";
+
+// Regression for the regex-free rewrite (ESLint no-control-regex): same output as the
+// former /[<>:"/\\|?*\u0000-\u001f]/g replacement.
+describe("safeFileName", () => {
+  it("replaces Windows-forbidden characters", () => {
+    assert.equal(safeFileName('a<b>c:d"e/f\\g|h?i*j'), "a_b_c_d_e_f_g_h_i_j");
+  });
+
+  it("replaces ASCII control characters but keeps umlauts and spaces", () => {
+    assert.equal(safeFileName("Büro\u0000 Nord\u001f\t"), "Büro_ Nord_");
+    assert.equal(safeFileName("x\u007fy"), "x\u007fy");
+  });
+
+  it("trims and falls back to Projekt", () => {
+    assert.equal(safeFileName("  Haus A  "), "Haus A");
+    assert.equal(safeFileName("   "), "Projekt");
+  });
+});