fix: harden admin actions, search, sanitization and repo hygiene

- Split approve/dismiss application workflows with distinct audit logs,
  rate-limited guards and real error logging
- Validate article status/date/id input and stop resetting publishedAt
  on every update
- Validate guild updates (state, forum enums, non-empty name) behind
  rate-limited guard
- Fix scheduled-article publishing (ignore NULL dates, set updatedAt,
  type-safe predicates)
- Harden admin search API (LIKE escaping, query cap, per-user
  rate limit, round-robin result cap) and fix search dialog
  abort/res.ok/loading races
- Lock down HTML sanitizer to an allowlist profile and add XSS tests
- Improve mobile nav accessibility (unique id, dialog role, focus
  management, scroll lock, outside close)
- Log swallowed server errors instead of silent catch blocks
- Remove dead eslint config, drop unused dompurify deps, restore knip
  CI step, add Playwright config with smoke spec

package.json

@@ -18,6 +18,7 @@
 		"diag:permissions": "tsx scripts/diagnose-permission-page.ts",
 		"jobs:worker": "tsx scripts/jobs-worker.ts",
 		"test": "vitest run",
+		"test:e2e": "playwright test",
 		"typecheck": "tsc --noEmit",
 		"db:generate": "drizzle-kit generate",
 		"db:migrate": "tsx scripts/apply-migrations.ts",
@@ -41,7 +42,6 @@
 		"clsx": "2.1.1",
 		"cmdk": "1.1.1",
 		"croner": "10.0.1",
-		"dompurify": "3.4.14",
 		"drizzle-orm": "0.45.2",
 		"hash-wasm": "4.12.0",
 		"ioredis": "6.0.0",
@@ -72,10 +72,10 @@
 	},
 	"devDependencies": {
 		"@biomejs/biome": "2.5.11",
+		"@playwright/test": "^1.62.1",
 		"@tailwindcss/forms": "0.5.11",
 		"@tailwindcss/postcss": "4.3.3",
 		"@tailwindcss/typography": "0.5.20",
-		"@types/dompurify": "^3.2.0",
 		"@types/node": "26.4.0",
 		"@types/react": "19.2.18",
 		"@types/react-dom": "19.2.5",