refactor: split monolithic app.py into modular Flask application with factory pattern

- Created app/ package with 6 modules:
  - __init__.py: Application factory (create_app function)
  - routes.py: All route handlers (473 lines)
  - models.py: Data persistence layer (41 lines)
  - validators.py: Input validation functions (48 lines)
  - email_service.py: Email sending functions (85 lines)
  - utils.py: Utility functions (30 lines)

- Implemented Flask application factory pattern
- Created run.py as minimal entry point
- Updated all test imports to use new module structure
- Fixed template/static folder paths for package structure

- All 102 tests passing
- Improved maintainability with clear separation of concerns
- Follows Flask best practices for scalable applications

app/__init__.py

@@ -0,0 +1,58 @@
+"""
+Flask job application system - Application factory module.
+"""
+from pathlib import Path
+from flask import Flask, redirect, url_for, flash
+from flask_mail import Mail
+from flask_wtf.csrf import CSRFProtect, CSRFError
+from config import Config
+
+# Initialize extensions (not bound to app yet)
+mail = Mail()
+csrf = CSRFProtect()
+
+
+def create_app(config_class=Config):
+    """
+    Application factory function.
+    Creates and configures the Flask application instance.
+
+    Args:
+        config_class: Configuration class to use (defaults to Config)
+
+    Returns:
+        Configured Flask application instance
+    """
+    # Create Flask app instance
+    # Specify template and static folders relative to project root (parent of app/)
+    app = Flask(__name__,
+                template_folder='../templates',
+                static_folder='../static')
+
+    # Load configuration
+    app.config.from_object(config_class)
+
+    # Initialize extensions with app
+    mail.init_app(app)
+    csrf.init_app(app)
+
+    # Ensure applications folder exists
+    Path(app.config['APPLICATIONS_FOLDER']).mkdir(exist_ok=True)
+
+    # Register error handlers
+    @app.errorhandler(CSRFError)
+    def handle_csrf_error(e):
+        """Handle CSRF validation errors."""
+        flash('Sicherheitsfehler: Die Sitzung ist abgelaufen. Bitte laden Sie die Seite neu und versuchen Sie es erneut.', 'error')
+        return redirect(url_for('page1_email')), 400
+
+    @app.errorhandler(429)
+    def handle_rate_limit_error(e):
+        """Handle rate limit errors."""
+        return str(e), 429
+
+    # Register routes
+    from app.routes import register_routes
+    register_routes(app, mail)
+
+    return app