fix: CI workflow and release readiness bugs

Merge pull request #29 from builderz-labs/test/e2e-critical-fixes

test: add 52 Playwright E2E tests covering all critical fixes

Merge pull request #28 from builderz-labs/docs/update-readme-post-fixes

docs: update README to reflect completed security and quality fixes

Merge pull request #27 from builderz-labs/fix/p3-cleanup

chore: CODE_OF_CONDUCT, issue templates, DELETE patterns, limit caps, CSRF origin check

Merge pull request #26 from builderz-labs/fix/p2-quality

fix: strict mode, test stubs, pagination counts, N+1 queries, CSP hardening

Merge pull request #25 from builderz-labs/fix/p1-security-high

fix: remove legacy auth, add login rate limiting, block SSRF metadata, parameterize migration SQL

Merge pull request #21 from builderz-labs/fix/p0-security-critical

fix: add auth checks on all GET endpoints, timing-safe comparisons, and XSS sanitization

docs: fix roadmap issue number references

docs: add project status, known limitations, and roadmap to README

feat: initial open-source release