fix: address remaining audit findings (major, medium, minor)

[Alithiel31]

Security & correctness:

• Sanitize markdown-rendered course content after HTML conversion instead of before, closing an XSS gap (marked output was never sanitized)
• Fix RBAC bug where requireSelfOrAdmin compared role to role.admin (always undefined) instead of ROLES.ADMIN
• Harden the avatar upload middleware: random filenames instead of predictable Date.now(), strict mimetype/extension whitelist

CI & tooling:

• Replace the lint workflow's fix+auto-commit-to-main steps with a single blocking npm run lint check per package
• Fix a pre-existing schema mismatch in a test that made the register endpoint's mocked-500 test return 400/409 instead
• Fix pre-existing test fixtures using a stale role field instead of roleId, which didn't match the current Prisma schema

Code quality:

• Split the 1625-line seeding.ts into per-entity data modules under models/seed-data/, seeding.ts is now a thin orchestrator
• Route console.info calls in the global error handler and a swallowed refresh-token error through the shared logger
• Add Zod validation to forgotPassword's email input
• Remove empty residual files (package.json.fixed, create_table.sql)
• Remove 2.4MB of confirmed-orphaned design assets from docs/

Docs & metadata:

• Replace the client's default sv create README with project- specific instructions
• Add CC BY-NC 4.0 LICENSE and align license fields in both package.json files
• Tighten .env.example's ALLOWED_ORIGINS example and .gitignore's secret-file patterns

Tests:

• Add regression tests for the two fixes above (role escalation via PATCH /users/:id, requireSelfOrAdmin's admin bypass)

Claude-Session: https://claude.ai/code/session_016RRHCP6bHMtmTEmcNFwe4D