test: add 52 Playwright E2E tests covering all critical fixes

fix: strict mode, test stubs, pagination counts, N+1 queries, CSP hardening

fix: remove legacy auth, add login rate limiting, block SSRF metadata, parameterize migration SQL

fix: add auth checks on all GET endpoints, timing-safe comparisons, and XSS sanitization

feat: initial open-source release