fix: comprehensive quality improvements

- Fix 2 backend test failures (projectFolders validation, StressTest timeout)
- Fix frontend test dependency (@testing-library/dom)
- Delete App.tsx.bak from repo
- Add rate limiting on auth endpoints (login: 10/min, register: 3/min)
- Add .env.example with all environment variables
- Update BAUPLAN.md with accurate phase status (16/21 phases implemented)
- Add OpenAPI/Swagger documentation (docs/openapi.yaml)
- Add E2E workflow test (15 steps: register→project→drawing→layer→element→CRUD→delete)
- Add Forgejo CI/CD pipeline (.forgejo/workflows/ci.yml)
- Improve .gitignore (db-wal, .env.*, *.bak, coverage)
- Add security comment for default user in schema.sql

All 628 tests passing (254 backend + 374 frontend)

backend/src/database/schema.sql

@@ -16,6 +16,8 @@ CREATE TABLE IF NOT EXISTS users (
 );
 
 -- ─── Default User (seed) ────────────────────────────
+-- Default user for foreign key constraints. Cannot login (empty password_hash
+-- means bcrypt.compare always fails). Real users must register explicitly.
 INSERT OR IGNORE INTO users (id, email, password_hash, name, role) VALUES ('user-default', 'default@webcad.local', '', 'Default User', 'admin');
 
 -- ─── Projects ───────────────────────────────────────