security: pre-release hardening, automated testing, and production readiness

SECURITY (critical fixes):
- Add authMiddleware to /api/system/console-token (was publicly accessible)
- Validate api_url on node create/update to prevent SSRF (rejects localhost/loopback)
- Add rate limiting (5 req/15 min/IP) to /api/auth/login and /api/auth/setup
- Fix path traversal in env_file resolution — absolute/escaping paths rejected
- Add stack name validation to GET routes (was only on PUT/POST)
- Add helmet security headers middleware
- Restrict CORS to FRONTEND_URL in production

PRODUCTION READINESS:
- Add GET /api/health public endpoint + HEALTHCHECK in Dockerfile
- Add SIGTERM/SIGINT graceful shutdown handler (drains connections, closes DB)
- Run container as non-root sencho user in Dockerfile

QUALITY:
- Fix 4 silent empty catch{} blocks in EditorLayout (now show toast.error)
- Connect ErrorBoundary to root App in main.tsx
- Replace WebSocket.Server with named WebSocketServer import (ESM compat)

TESTING (new automated test suite):
- Install Vitest; 38 backend tests across 4 suites covering validation utilities,
  health endpoint, auth middleware, login flows, SSRF protection, and path traversal
- Extract isValidStackName/isValidRemoteUrl/isPathWithinBase to utils/validation.ts
- Playwright E2E scaffolding: auth, stacks, nodes specs + shared login helper
- CI: run Vitest + ESLint on every PR

e2e/nodes.spec.ts

@@ -0,0 +1,54 @@
+/**
+ * Node management E2E tests.
+ * Tests the SSRF validation we added (C2 fix) is surfaced in the UI.
+ */
+import { test, expect } from '@playwright/test';
+import { loginAs } from './helpers';
+
+test.describe('Node management', () => {
+  test.beforeEach(async ({ page }) => {
+    await loginAs(page);
+    // Navigate to the nodes section (Settings / Node Manager)
+    const nodesBtn = page.getByRole('button', { name: /nodes|manage nodes|settings/i }).first();
+    if (await nodesBtn.isVisible()) await nodesBtn.click();
+  });
+
+  test('adding a node with localhost api_url shows a validation error', async ({ page }) => {
+    // Open "add node" dialog
+    const addBtn = page.getByRole('button', { name: /add node|new node|\+/i });
+    if (!await addBtn.isVisible()) {
+      test.skip();
+      return;
+    }
+    await addBtn.click();
+
+    await page.getByLabel(/node name/i).fill('bad-node');
+    // Select "remote" type if there's a type selector
+    const typeSelect = page.getByLabel(/type/i);
+    if (await typeSelect.isVisible()) await typeSelect.selectOption('remote');
+
+    await page.getByLabel(/api url/i).fill('http://localhost:6379');
+    await page.getByRole('button', { name: /add|save|create/i }).click();
+
+    // Should see an error about loopback/localhost
+    await expect(page.getByText(/loopback|localhost/i)).toBeVisible({ timeout: 3_000 });
+  });
+
+  test('adding a node with an invalid URL shows an error', async ({ page }) => {
+    const addBtn = page.getByRole('button', { name: /add node|new node|\+/i });
+    if (!await addBtn.isVisible()) {
+      test.skip();
+      return;
+    }
+    await addBtn.click();
+
+    await page.getByLabel(/node name/i).fill('bad-url-node');
+    const typeSelect = page.getByLabel(/type/i);
+    if (await typeSelect.isVisible()) await typeSelect.selectOption('remote');
+
+    await page.getByLabel(/api url/i).fill('not-a-url-at-all');
+    await page.getByRole('button', { name: /add|save|create/i }).click();
+
+    await expect(page.getByText(/valid url|invalid url|url/i)).toBeVisible({ timeout: 3_000 });
+  });
+});