Migrate the API to native ESM and vitest; pin Node 26

Prep PR for the admin auth module (docs/plan-admin-auth.md step 1).
better-auth 1.7 ships ESM only, so the API moves off CommonJS:

- "type": "module", module nodenext, target ES2024, .js suffixes on all
  relative imports, require('mariadb'|'cors') replaced by imports, and
  export= packages (winston, app-root-path, bcrypt) consumed via default
  imports. The logger now uses appRoot.path explicitly.
- TypeScript 5.9, @types/node 26, tslint removed. Node 26 pinned via
  engines and .nvmrc (Plesk runs 26).
- Jest 28 + ts-jest replaced by vitest 5. Eight test files depend on
  hoisted module mocks with static imports and resetModules + require,
  which Jest's ESM mode does not support; vitest keeps them nearly
  verbatim. Coverage via @vitest/coverage-v8 (lcov), Sonar generic report
  via vitest-sonar-reporter, so sonar-project.properties is unchanged.
  vitest.config.ts sets FEEDBACK_IP_SALT so the suite passes without a
  local .env.
- dotenv 8 -> 16 and axios 0.24 -> 1.x: their old typings are not
  resolvable under nodenext.
- autoCommit: false dropped from the pool configs; it is not a mariadb
  connector option and was silently ignored.

tsc clean, 96/96 tests green, compiled app boots and serves /, /docs and
CORS under Node ESM.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

src/models/feedback/public/events.public.service.ts

@@ -1,5 +1,5 @@
-import {NachklangFeedbackDB} from '../Feedback.db';
-import {EventConfig, EventSummary, Question, Song} from '../feedback.interface';
+import {NachklangFeedbackDB} from '../Feedback.db.js';
+import {EventConfig, EventSummary, Question, Song} from '../feedback.interface.js';
 
 /**
  * Returns all events currently eligible to receive feedback:

src/models/feedback/public/public.router.ts

@@ -2,11 +2,11 @@
  * Required External Modules and Interfaces
  */
 import express, {Request, Response} from 'express';
-import logger from '../../../middleware/logger';
-import {getEligibleEvents, getEventConfigBySlug} from './events.public.service';
-import {submitFeedback} from './submissions.service';
-import {hashIp, isRateLimited, recordSubmission} from '../feedback.ratelimit';
-import {sendServerError} from '../feedback.errors';
+import logger from '../../../middleware/logger.js';
+import {getEligibleEvents, getEventConfigBySlug} from './events.public.service.js';
+import {submitFeedback} from './submissions.service.js';
+import {hashIp, isRateLimited, recordSubmission} from '../feedback.ratelimit.js';
+import {sendServerError} from '../feedback.errors.js';
 
 /**
  * Router Definition

src/models/feedback/public/submissions.service.ts

@@ -1,9 +1,9 @@
-import {NachklangFeedbackDB} from '../Feedback.db';
-import {QuestionType} from '../feedback.interface';
-import {getEventConfigBySlug} from './events.public.service';
-import {AnswerInput, GuestBookInput, NewsletterInput, SubmissionRequestBody} from './submission.interface';
-import {syncNewsletterSignup} from '../integrations/salesforce.service';
-import logger from '../../../middleware/logger';
+import {NachklangFeedbackDB} from '../Feedback.db.js';
+import {QuestionType} from '../feedback.interface.js';
+import {getEventConfigBySlug} from './events.public.service.js';
+import {AnswerInput, GuestBookInput, NewsletterInput, SubmissionRequestBody} from './submission.interface.js';
+import {syncNewsletterSignup} from '../integrations/salesforce.service.js';
+import logger from '../../../middleware/logger.js';
 
 // Bump when the privacy/consent copy shown next to the newsletter opt-in
 // changes; recorded per-signup so a past consent's exact wording is provable.