security: pre-release hardening, automated testing, and production readiness

SECURITY (critical fixes):
- Add authMiddleware to /api/system/console-token (was publicly accessible)
- Validate api_url on node create/update to prevent SSRF (rejects localhost/loopback)
- Add rate limiting (5 req/15 min/IP) to /api/auth/login and /api/auth/setup
- Fix path traversal in env_file resolution — absolute/escaping paths rejected
- Add stack name validation to GET routes (was only on PUT/POST)
- Add helmet security headers middleware
- Restrict CORS to FRONTEND_URL in production

PRODUCTION READINESS:
- Add GET /api/health public endpoint + HEALTHCHECK in Dockerfile
- Add SIGTERM/SIGINT graceful shutdown handler (drains connections, closes DB)
- Run container as non-root sencho user in Dockerfile

QUALITY:
- Fix 4 silent empty catch{} blocks in EditorLayout (now show toast.error)
- Connect ErrorBoundary to root App in main.tsx
- Replace WebSocket.Server with named WebSocketServer import (ESM compat)

TESTING (new automated test suite):
- Install Vitest; 38 backend tests across 4 suites covering validation utilities,
  health endpoint, auth middleware, login flows, SSRF protection, and path traversal
- Extract isValidStackName/isValidRemoteUrl/isPathWithinBase to utils/validation.ts
- Playwright E2E scaffolding: auth, stacks, nodes specs + shared login helper
- CI: run Vitest + ESLint on every PR

backend/src/__tests__/helpers/setupTestDb.ts

@@ -0,0 +1,46 @@
+/**
+ * Test DB helper — creates a temporary SQLite database, seeds it with a known
+ * admin credential, and sets process.env so DatabaseService uses it.
+ *
+ * Call this at the top of every test file *before* importing the app,
+ * because DatabaseService initialises its path on first getInstance() call.
+ */
+import os from 'os';
+import path from 'path';
+import fs from 'fs';
+import bcrypt from 'bcrypt';
+import crypto from 'crypto';
+
+export const TEST_USERNAME = 'testadmin';
+export const TEST_PASSWORD = 'testpassword123';
+export let TEST_JWT_SECRET = '';
+
+export async function setupTestDb(): Promise<string> {
+  const tmpDir = fs.mkdtempSync(path.join(os.tmpdir(), 'sencho-test-'));
+  process.env.DATA_DIR = tmpDir;
+  // Also point COMPOSE_DIR to a temp dir so FileSystemService doesn't fail on missing dir
+  const composeDir = path.join(tmpDir, 'compose');
+  fs.mkdirSync(composeDir, { recursive: true });
+  process.env.COMPOSE_DIR = composeDir;
+
+  // Initialise the DB (singleton will use DATA_DIR we just set)
+  const { DatabaseService } = await import('../../services/DatabaseService');
+  const db = DatabaseService.getInstance();
+
+  // Seed admin credentials
+  const passwordHash = await bcrypt.hash(TEST_PASSWORD, 1); // cost=1 for speed in tests
+  TEST_JWT_SECRET = crypto.randomBytes(32).toString('hex');
+  db.updateGlobalSetting('auth_username', TEST_USERNAME);
+  db.updateGlobalSetting('auth_password_hash', passwordHash);
+  db.updateGlobalSetting('auth_jwt_secret', TEST_JWT_SECRET);
+
+  return tmpDir;
+}
+
+export function cleanupTestDb(tmpDir: string): void {
+  try {
+    fs.rmSync(tmpDir, { recursive: true, force: true });
+  } catch {
+    // best-effort cleanup
+  }
+}