Merge pull request 'Migrate the API to native ESM and vitest; pin Node 26' (#10) from feature/api-esm-prep into master

Reviewed-on: #10

.env.example

@@ -1,5 +1,3 @@
-# Values containing #, ", \ or surrounding spaces must be single-quoted
-# (dotenv 16 treats an unquoted # as a comment): DB_PASSWORD='abc#def'
 PORT=3000
 
 DB_HOST=

CLAUDE.md

@@ -47,11 +47,6 @@ Express.js REST API in TypeScript with a service-oriented layering. Domains: `Ca
 
 ## Environment
 
-dotenv 16 parses `.env` stricter than the old dotenv 8: an unquoted `#` starts a comment and
-backslash escapes inside double quotes are expanded. Wrap any value containing `#`, `"`, `\` or
-surrounding spaces in single quotes (`DB_PASSWORD='abc#def'`), which are taken literally.
-A truncated password shows up as MariaDB "Access denied ... (using password: YES)".
-
 Copy `.env.example` (or create `.env`) with:
 ```
 PORT=