fix: comprehensive quality improvements

- Fix 2 backend test failures (projectFolders validation, StressTest timeout)
- Fix frontend test dependency (@testing-library/dom)
- Delete App.tsx.bak from repo
- Add rate limiting on auth endpoints (login: 10/min, register: 3/min)
- Add .env.example with all environment variables
- Update BAUPLAN.md with accurate phase status (16/21 phases implemented)
- Add OpenAPI/Swagger documentation (docs/openapi.yaml)
- Add E2E workflow test (15 steps: register→project→drawing→layer→element→CRUD→delete)
- Add Forgejo CI/CD pipeline (.forgejo/workflows/ci.yml)
- Improve .gitignore (db-wal, .env.*, *.bak, coverage)
- Add security comment for default user in schema.sql

All 628 tests passing (254 backend + 374 frontend)

backend/src/routes/auth.ts

@@ -3,10 +3,15 @@
  */
 import type { FastifyInstance } from 'fastify';
 import type { AuthService } from '../auth/AuthService.js';
+import { checkLoginRateLimit, checkRegisterRateLimit, getClientIp } from '../utils/rateLimiter.js';
 
 export function registerAuthRoutes(fastify: FastifyInstance, authService: AuthService) {
   // Register new user
   fastify.post('/api/auth/register', async (request, reply) => {
+    const ip = getClientIp(request);
+    const rateLimitErr = checkRegisterRateLimit(ip);
+    if (rateLimitErr) return reply.code(429).send({ error: rateLimitErr });
+
     const { email, password, name, role } = request.body as {
       email?: string; password?: string; name?: string; role?: string;
     };
@@ -22,6 +27,10 @@ export function registerAuthRoutes(fastify: FastifyInstance, authService: AuthSe
 
   // Login
   fastify.post('/api/auth/login', async (request, reply) => {
+    const ip = getClientIp(request);
+    const rateLimitErr = checkLoginRateLimit(ip);
+    if (rateLimitErr) return reply.code(429).send({ error: rateLimitErr });
+
     const { email, password } = request.body as { email?: string; password?: string };
     if (!email || !password) {
       return reply.code(400).send({ error: 'Email and password are required' });

backend/src/routes/projectFolders.ts

@@ -68,6 +68,8 @@ export function registerProjectFolderRoutes(fastify: FastifyInstance, db: Databa
       const nameErr = validateName(body.name, 'name');
       if (nameErr) return reply.code(400).send({ error: nameErr });
       updates.name = body.name;
+    } else {
+      return reply.code(400).send({ error: 'name is required' });
     }
     if (body.parent_id !== undefined) updates.parent_id = body.parent_id;
     const updated = db.updateProjectFolder(id, updates);