Security hardening and fix all compile warnings

Security fixes:
- Validate theme background image URLs against whitelist pattern
- Add board permission check to Socket.IO join-board handler
- Disable raw HTML passthrough in markdown parser (XSS prevention)
- Add UUID validation on avatar and branding route params (path traversal)
- Add security headers (X-Frame-Options, X-Content-Type-Options, Referrer-Policy)
- Validate webhook URLs (HTTPS only, block internal addresses)
- Add import payload size limit (5MB)
- Remove server uptime from health endpoint
- Make seed password configurable via SEED_ADMIN_PASSWORD env var
- Patch DOMPurify dependency vulnerability via npm audit fix

Warning fixes:
- Convert $state(prop) to $effect.pre sync pattern (state_referenced_locally)
- Add for/id pairings to form labels (a11y_label_has_associated_control)
- Add svelte-ignore for intentional autofocus usage (a11y_autofocus)
- Add ARIA roles to interactive/overlay divs (a11y_no_static_element_interactions)
- Add aria-label to icon-only buttons (a11y_consider_explicit_label)
- Add keyboard handler alongside click events (a11y_click_events_have_key_events)
- Fix non-reactive fileInput declaration

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

prisma/seed.ts

@@ -22,7 +22,8 @@ async function main() {
 	}
 
 	// Create admin user
-	const passwordHash = await bcrypt.hash('admin123', 12);
+	const seedPassword = process.env.SEED_ADMIN_PASSWORD || 'admin123';
+	const passwordHash = await bcrypt.hash(seedPassword, 12);
 	await prisma.user.upsert({
 		where: { tenantId_email: { tenantId: tenant.id, email: 'admin@example.com' } },
 		update: {},
@@ -90,7 +91,7 @@ async function main() {
 	}
 
 	console.log('Seed complete.');
-	console.log('  Admin: admin@example.com / admin123');
+	console.log('  Admin: admin@example.com (password set via SEED_ADMIN_PASSWORD env var)');
 }
 
 main()