chore: repo consistency parity + wire CSRF (CLAUDE.md, CI, typecheck, .env.example, healthcheck)

[RayderC]

Part of a cross-repo consistency pass across AstroFit / Amethyst / ComicOrbit / SkyBit. No breaking changes — cookie names, env var names, ports, and volume paths are untouched.

Changes in this repo

• Wire up CSRF (security fix). lib/csrf.ts existed but was never called by any route. checkCsrf is now enforced on every mutating pages/api handler (projects, sessions, users, site-config, register, logout), with /api/setup and /api/login left exempt — matching the sibling repos. The App Router upload route (app/api/upload/route.ts) keeps an equivalent inline origin/host check.
• CLAUDE.md — new codebase guide (architecture, auth/CSRF, schema, design system, Docker).
• typecheck script + .github/workflows/ci.yml (lint → typecheck → build on Node 20).
• .env.example and Docker HEALTHCHECK.
• lint script → eslint . (next lint was removed in Next 16) and eslint.config.mjs aligned with siblings.
• Security headers — X-Content-Type-Options / X-Frame-Options added in next.config.ts.

Verification

npm run lint (0 errors), npm run typecheck, and npm run build all pass.

https://claude.ai/code/session_013yX3FPohZkQNiUGSNwwjbM

---

Generated by Claude Code