security: pre-release hardening, automated testing, and production readiness

SECURITY (critical fixes):
- Add authMiddleware to /api/system/console-token (was publicly accessible)
- Validate api_url on node create/update to prevent SSRF (rejects localhost/loopback)
- Add rate limiting (5 req/15 min/IP) to /api/auth/login and /api/auth/setup
- Fix path traversal in env_file resolution — absolute/escaping paths rejected
- Add stack name validation to GET routes (was only on PUT/POST)
- Add helmet security headers middleware
- Restrict CORS to FRONTEND_URL in production

PRODUCTION READINESS:
- Add GET /api/health public endpoint + HEALTHCHECK in Dockerfile
- Add SIGTERM/SIGINT graceful shutdown handler (drains connections, closes DB)
- Run container as non-root sencho user in Dockerfile

QUALITY:
- Fix 4 silent empty catch{} blocks in EditorLayout (now show toast.error)
- Connect ErrorBoundary to root App in main.tsx
- Replace WebSocket.Server with named WebSocketServer import (ESM compat)

TESTING (new automated test suite):
- Install Vitest; 38 backend tests across 4 suites covering validation utilities,
  health endpoint, auth middleware, login flows, SSRF protection, and path traversal
- Extract isValidStackName/isValidRemoteUrl/isPathWithinBase to utils/validation.ts
- Playwright E2E scaffolding: auth, stacks, nodes specs + shared login helper
- CI: run Vitest + ESLint on every PR

playwright.config.ts

@@ -0,0 +1,35 @@
+import { defineConfig, devices } from '@playwright/test';
+
+/**
+ * Playwright E2E config for Sencho.
+ *
+ * Before running: ensure both dev servers are up:
+ *   cd backend && npm run dev &
+ *   cd frontend && npm run dev &
+ *
+ * Or use the webServer config below (which starts them automatically).
+ */
+export default defineConfig({
+  testDir: './e2e',
+  // Stop on first failure to save time during development
+  maxFailures: 1,
+  // How long to wait for a single test
+  timeout: 30_000,
+  // How long to wait for an expect() assertion
+  expect: { timeout: 5_000 },
+  // Run tests serially — Sencho is a single-user app and tests share DB state
+  workers: 1,
+  reporter: [['list'], ['html', { outputFolder: 'e2e/report', open: 'never' }]],
+
+  use: {
+    baseURL: 'http://localhost:5173',
+    // Persist auth state between tests in the same file
+    storageState: undefined,
+    trace: 'on-first-retry',
+    screenshot: 'only-on-failure',
+  },
+
+  projects: [
+    { name: 'chromium', use: { ...devices['Desktop Chrome'] } },
+  ],
+});