merge: cherry-pick e1b96310 (security + type-safety + auth middleware) from web-cad

Brings the following 28.06 improvements into web-cad-neu:
- backend/src/auth/authMiddleware.ts: shared requireAuth/requireAdmin middleware
- backend/src/routes/users.ts: admin role checks (critical security fix)
- 6 routes (projects, drawings, elements, layers, blocks, settings): requireAuth
- server.ts: per-route auth (defense-in-depth alongside global hook)
- 6 test files: auth setup + 401 tests
- Frontend: type safety fixes (App.tsx, RenderEngine, SnapEngine, etc.)
- 10 components: SVG stroke-width/linecap/linejoin -> camelCase
- PropertiesPanel: formatPos/formatDim/parseNum helpers
- LayerPanel: aria-labels
- WORKLOG.md: historical worklog from 28.06

Conflicts resolved (4 blocks, all kept HEAD + e1b96310 improvements):
- LayerPanel.tsx: kept HEAD display:flex + e1b96310 aria-label
- PropertiesPanel.tsx: kept HEAD onDelete handler + e1b96310 formatPos helpers
- PropertiesPanel.tsx: kept HEAD delete button (feature) + full inline styles
- Topbar.tsx: kept HEAD onClick + e1b96310 camelCase SVG attrs

Refs: CODE_ANALYSIS.md (Issue #1 partially improved), e1b96310

frontend/src/App.tsx

@@ -737,7 +737,7 @@ const CADEditor: React.FC<CADEditorProps> = ({ projectId, token, onNavigateBack
     if (action === 'undo') { handleUndo(); return; }
     if (action === 'redo') { handleRedo(); return; }
     if (action === 'copy') {
-      const selected = elements.filter((e) => (e as any).selected);
+      const selected = selectedElement ? [selectedElement] : [];
       const clip = selected.length > 0 ? selected : elements.slice(0, 1);
       clipboardRef.current = clip;
       setCommandHistory((prev) => [...prev, { prefix: '·', text: `${clip.length} Element(e) kopiert`, type: 'info' }]);
@@ -749,8 +749,8 @@ const CADEditor: React.FC<CADEditorProps> = ({ projectId, token, onNavigateBack
         const pasted = clipboardRef.current.map((el, i) => ({
           ...el,
           id: `el-${Date.now()}-${i}`,
-          x: (el as any).x ? (el as any).x + offset : undefined,
-          y: (el as any).y ? (el as any).y + offset : undefined,
+          x: (el.x ?? 0) + offset,
+          y: (el.y ?? 0) + offset,
         }));
         setElements((prev) => [...prev, ...pasted]);
         setCommandHistory((prev) => [...prev, { prefix: '·', text: `${pasted.length} Element(e) eingefügt`, type: 'info' }]);
@@ -776,11 +776,13 @@ const CADEditor: React.FC<CADEditorProps> = ({ projectId, token, onNavigateBack
           reader.onload = () => {
             const imgEl: CADElement = {
               id: `el-${Date.now()}`,
-              type: 'image' as any,
+              type: 'image',
               layerId: activeLayerId,
               x: 0, y: 0,
-              properties: { src: reader.result as string, width: 200, height: 200 },
-            } as any;
+              width: 200,
+              height: 200,
+              properties: { src: reader.result as string },
+            };
             setElements((prev) => [...prev, imgEl]);
             setCommandHistory((prev) => [...prev, { prefix: '·', text: 'Bild eingefügt', type: 'info' }]);
           };