merge: cherry-pick e1b96310 (security + type-safety + auth middleware) from web-cad

Brings the following 28.06 improvements into web-cad-neu:
- backend/src/auth/authMiddleware.ts: shared requireAuth/requireAdmin middleware
- backend/src/routes/users.ts: admin role checks (critical security fix)
- 6 routes (projects, drawings, elements, layers, blocks, settings): requireAuth
- server.ts: per-route auth (defense-in-depth alongside global hook)
- 6 test files: auth setup + 401 tests
- Frontend: type safety fixes (App.tsx, RenderEngine, SnapEngine, etc.)
- 10 components: SVG stroke-width/linecap/linejoin -> camelCase
- PropertiesPanel: formatPos/formatDim/parseNum helpers
- LayerPanel: aria-labels
- WORKLOG.md: historical worklog from 28.06

Conflicts resolved (4 blocks, all kept HEAD + e1b96310 improvements):
- LayerPanel.tsx: kept HEAD display:flex + e1b96310 aria-label
- PropertiesPanel.tsx: kept HEAD onDelete handler + e1b96310 formatPos helpers
- PropertiesPanel.tsx: kept HEAD delete button (feature) + full inline styles
- Topbar.tsx: kept HEAD onClick + e1b96310 camelCase SVG attrs

Refs: CODE_ANALYSIS.md (Issue #1 partially improved), e1b96310

frontend/src/services/dimensionService.ts

@@ -15,7 +15,7 @@ export interface DimensionConfig {
   y2: number;
   offsetX: number;
   offsetY: number;
-  unit: 'm' | 'cm' | 'mm';
+  unit: 'm' | 'cm' | 'mm' | 'deg';
   precision: number;
 }
 
@@ -105,7 +105,7 @@ export class DimensionService {
     vx: number, vy: number, x1: number, y1: number, x2: number, y2: number,
     layerId: string, config: Partial<DimensionConfig> = {},
   ): CADElement {
-    const cfg = { type: 'angular' as DimensionType, x1: vx, y1: vy, x2, y2, offsetX: 0, offsetY: -30, unit: 'deg' as any, precision: 1, ...config };
+    const cfg = { type: 'angular' as DimensionType, x1: vx, y1: vy, x2, y2, offsetX: 0, offsetY: -30, unit: 'deg' as const, precision: 1, ...config };
     const a1 = Math.atan2(y1 - vy, x1 - vx);
     const a2 = Math.atan2(y2 - vy, x2 - vx);
     let angle = Math.abs(a2 - a1) * 180 / Math.PI;
@@ -232,6 +232,7 @@ export class DimensionService {
       case 'm': val = dist / 100; suffix = ' m'; break;
       case 'cm': val = dist / 10; suffix = ' cm'; break;
       case 'mm': val = dist; suffix = ' mm'; break;
+      case 'deg': val = dist; suffix = '°'; break;
       default: suffix = '';
     }
     return `${val.toFixed(precision)}${suffix}`;

frontend/src/services/exportService.ts

@@ -156,7 +156,7 @@ function elementToSVG(el: CADElement, layerColor?: string): string | null {
   const stroke = (p.stroke as string) || layerColor || '#000000';
   const sw = p.strokeWidth ?? 1;
   const fill = p.fill as string || 'none';
-  const style = `stroke="${stroke}" stroke-width="${sw}" fill="${fill}"`;
+  const style = `stroke="${stroke}" strokeWidth="${sw}" fill="${fill}"`;
 
   switch (el.type) {
     case 'line': {