fix: QA sweep fixes across migration, security, lint, and e2e tests

- fix(db): migration 0012 column order mismatch causing NOT NULL
  constraint failure on existing databases; use explicit column
  mapping instead of SELECT *
- fix(db): disable FK checks during migrations to allow SQLite
  table-recreation pattern (DROP + RENAME)
- fix(security): filter cookie_secret and instance_id from settings
  API response for non-admin users
- fix(lint): resolve all 7 API lint warnings (noParameterAssign,
  noImplicitAnyLet) in compose, image-enhancement, and workspace
- fix(docs): correct permission count from 16 to 14 in CLAUDE.md
- fix(e2e): resolve 44 Playwright test failures across 8 spec files
  including locator specificity, compress mode defaults, format count,
  restore-photo UI drift, stitch image count, GIF animated fixtures,
  submit button timing, and processing timeouts

apps/api/src/db/migrate.ts

@@ -1,7 +1,7 @@
 import { dirname, join } from "node:path";
 import { fileURLToPath } from "node:url";
 import { migrate } from "drizzle-orm/better-sqlite3/migrator";
-import { db } from "./index.js";
+import { db, sqlite } from "./index.js";
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -24,6 +24,10 @@ let migrated = false;
 
 export function runMigrations() {
   if (migrated) return;
+  // Temporarily disable FK checks so table-recreation migrations
+  // (DROP + RENAME pattern) can proceed without constraint errors.
+  // Must be set outside any transaction to take effect in SQLite.
+  sqlite.pragma("foreign_keys = OFF");
   try {
     migrate(db, { migrationsFolder });
   } catch (err: unknown) {
@@ -37,6 +41,8 @@ export function runMigrations() {
     } else {
       throw err;
     }
+  } finally {
+    sqlite.pragma("foreign_keys = ON");
   }
   migrated = true;
 }