Fix stored XSS vulnerabilities and unauthenticated auth toggle

- Sanitize project notes with DOMPurify before rendering via
    dangerouslySetInnerHTML (ProjectDetailPage.tsx)
  - Replace hand-rolled HTML sanitizer with DOMPurify in ProjectPageModal
    to prevent attribute injection via crafted 3MF href values
  - Block /api/v1/auth/setup when auth is already enabled to prevent
    unauthenticated clients from disabling authentication remotely

backend/app/api/routes/auth.py

@@ -157,7 +157,13 @@ async def setup_auth(request: SetupRequest, db: AsyncSession = Depends(get_db)):
     logger = logging.getLogger(__name__)
 
     try:
-        # If auth_enabled is true but no users exist, allow re-setup (recovery scenario)
+        # If auth is currently enabled, block unauthenticated setup changes.
+        # Use the admin panel (/disable endpoint) to modify auth when it's already on.
+        if await is_auth_enabled(db):
+            raise HTTPException(
+                status_code=status.HTTP_403_FORBIDDEN,
+                detail="Authentication is already configured. Use the admin panel to modify auth settings.",
+            )
 
         admin_created = False