* update mongoose, jest and nodemon to address security alerts triggered
  by dependabot
* 'test' target had a bug introduced by using wrong syntax
* renamed server scripts to clarify the distinction between invocations
  in local development, CI and actual operations

* introduce a test on the server to see if user creation works (backend process <-> db only;
  still needs a test that involves the router, too)
* main server process is no connection-aware and wont start if database is not reachable
* some renaming, cause it's more descriptive
* unify quote usage

* update deps to latest and pin min node & npm version
* checkin lock files
* make server serve client to merge both into one in order to reduce complexity
* adjust CSP accordingly