Harden scaffold (reviewer followups)

- main.ts awaits DatabaseInitService.init() before app.listen(), ensuring
  migrations + seed run before the HTTP server accepts traffic.
- AppModule now uses NestModule with consumer.apply() no longer needed for
  CSRF (registered globally via app.use after body parsers in main.ts).
- JwtAuthGuard extended from AuthGuard('jwt') so protected endpoints
  actually validate the bearer token.
- Admin controller now uses Zod-validated DTOs for body/path/query:
  createUser, updateUserRole, userIdParam, listUsersQuery; with @Public
  / @Roles decorators and AdminGuard applied.
- Multer upload module + controller (POST /api/v1/uploads/category-icon
  and /challenge-file) with safe-filename strategy, configured
  UPLOAD_SIZE_LIMIT, admin-only via AdminGuard, served via /uploads
  static handler.
- ThemeLoaderService now requires all 10 canonical theme ids at startup,
  backfilling missing themes from built-ins with a warning; validates the
  configured themeKey setting and falls back to 'classic' if invalid;
  gracefully tolerates missing setting table during early boot.
- Test suite expanded to 76 tests / 17 suites; new specs:
  admin-validation, uploads, theme-required, database-init.

tests/backend/theme-loader.spec.ts

@@ -5,16 +5,21 @@ import { ThemeLoaderService } from '../../backend/src/common/utils/theme-loader.
 
 describe('ThemeLoaderService', () => {
   const config = { get: jest.fn() } as any;
+  // ThemeLoaderService now takes SettingsService for the configured-theme
+  // validation step. We pass a stub that always returns 'classic' so the
+  // existing tests focus on disk loading + lookup behavior.
+  const settings = { get: jest.fn().mockResolvedValue('classic') } as any;
 
   it('falls back to default and warns on unknown theme id', () => {
     const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'themes-'));
     fs.writeFileSync(path.join(tmp, 'classic.json'), JSON.stringify({ id: 'classic', name: 'Classic', tokens: { primary: '#000', secondary: '#111', accent: '#222', surface: '#fff', text: '#000', success: '#0f0', warning: '#ff0', danger: '#f00', fontFamily: 'sans', radii: { sm: '1px', md: '2px', lg: '3px' }, spacingScale: [4, 8] } }));
     config.get.mockImplementation((k: string, d: any) => (k === 'THEMES_DIR' ? tmp : d));
-    const svc = new ThemeLoaderService(config);
-    svc.onModuleInit();
-    const t = svc.getTheme('does-not-exist');
-    expect(t.id).toBe('classic');
-    expect(t.tokens.primary).toBe('#000');
+    const svc = new ThemeLoaderService(config, settings);
+    return svc.onModuleInit().then(() => {
+      const t = svc.getTheme('does-not-exist');
+      expect(t.id).toBe('classic');
+      expect(t.tokens.primary).toBe('#000');
+    });
   });
 
   it('loads a valid theme by id', () => {
@@ -22,21 +27,23 @@ describe('ThemeLoaderService', () => {
     const theme = { id: 'classic', name: 'Classic', tokens: { primary: '#000', secondary: '#111', accent: '#222', surface: '#fff', text: '#000', success: '#0f0', warning: '#ff0', danger: '#f00', fontFamily: 'sans', radii: { sm: '1px', md: '2px', lg: '3px' }, spacingScale: [4, 8] } };
     fs.writeFileSync(path.join(tmp, 'classic.json'), JSON.stringify(theme));
     config.get.mockImplementation((k: string, d: any) => (k === 'THEMES_DIR' ? tmp : d));
-    const svc = new ThemeLoaderService(config);
-    svc.onModuleInit();
-    const t = svc.getTheme('classic');
-    expect(t.id).toBe('classic');
-    expect(t.tokens.spacingScale).toEqual([4, 8]);
+    const svc = new ThemeLoaderService(config, settings);
+    return svc.onModuleInit().then(() => {
+      const t = svc.getTheme('classic');
+      expect(t.id).toBe('classic');
+      expect(t.tokens.spacingScale).toEqual([4, 8]);
+    });
   });
 
   it('skips invalid theme files', () => {
     const tmp = fs.mkdtempSync(path.join(os.tmpdir(), 'themes-'));
     fs.writeFileSync(path.join(tmp, 'classic.json'), JSON.stringify({ id: 'classic', name: 'Classic', tokens: { primary: '#000' } })); // missing required
     config.get.mockImplementation((k: string, d: any) => (k === 'THEMES_DIR' ? tmp : d));
-    const svc = new ThemeLoaderService(config);
-    svc.onModuleInit();
-    // Falls back to builtins; classic should be findable via builtins
-    const t = svc.getTheme('classic');
-    expect(t).toBeDefined();
+    const svc = new ThemeLoaderService(config, settings);
+    return svc.onModuleInit().then(() => {
+      // Falls back to builtins; classic should be findable via builtins
+      const t = svc.getTheme('classic');
+      expect(t).toBeDefined();
+    });
   });
 });