feat: allow users to delete projects

backend/server.js

@@ -1,3 +1,4 @@
+require('dotenv').config();
 const express = require('express');
 const cors = require('cors');
 const bcrypt = require('bcrypt');
@@ -8,6 +9,7 @@ const path = require('path');
 const fs = require('fs');
 
 const { db, run, get, all } = require('./database');
+const { sendMail } = require('./mail');
 
 const app = express();
 app.use(cors());
@@ -156,6 +158,21 @@ app.post('/api/projects', authenticate, async (req, res) => {
   }
 });
 
+app.delete('/api/projects/:id', authenticate, async (req, res) => {
+  const { id } = req.params;
+  try {
+    const existing = await get('SELECT * FROM projects WHERE id = ?', [id]);
+    if (!existing) return res.status(404).json({ error: 'Not found' });
+    if (existing.user_id !== req.user.id && req.user.role !== 'admin') {
+      return res.status(403).json({ error: 'Forbidden' });
+    }
+    await run('DELETE FROM projects WHERE id = ?', [id]);
+    res.json({ success: true });
+  } catch (err) {
+    res.status(500).json({ error: err.message });
+  }
+});
+
 // 7. Get users (Admin only)
 app.get('/api/users', authenticate, async (req, res) => {
   if (req.user.role !== 'admin') return res.status(403).json({ error: 'Forbidden' });