TipTap editor, version history, search, attachments — and a cleanup

The app is meant to run in daily private use now, so this pass was mostly
about the ways it could quietly lose data.

Reliability and security:
- the server no longer invents a JWT_SECRET or ENCRYPTION_KEY when one is
  missing; it refuses to start. The old fallback silently made every stored
  note unreadable after a restart.
- notes are encrypted with AES-256-GCM (v2:); existing CBC bodies still read.
- login is rate limited and compares against a dummy hash when the user does
  not exist, so timing does not reveal who is registered.
- a server response issued before a local save is never adopted. This had
  already eaten drawing strokes and note links; sync.hasPendingWrites() now
  guards every path that takes a body from the server.

Editor and features:
- TipTap replaces the contenteditable editor: tables, task lists, and links
  to other notes and notebooks, with a backlinks bar on the target.
- content format v2 ({v:2,doc}); v1 {html,tasks} bodies migrate on open.
- version history: the state before each write is snapshotted, coalesced
  into 5-minute windows, 50 versions or 90 days per note.
- full-text search runs in the client, because the server cannot read
  encrypted bodies and a server index would defeat the encryption.
- image attachments are stored by SHA-256 and deduplicated; the client
  fetches them authenticated and caches the blob, so they work offline.
- drawings are vector strokes in a fixed 1200x1600 page space and now look
  the same on every screen (0.0-0.2% deviation across four widths).
- login is by username; existing email accounts migrate automatically.

Operations:
- data lives on host bind mounts, not Docker volumes, so Proxmox Backup
  covers it. Back up .env with it — without ENCRYPTION_KEY the dump is
  unreadable.

Structure:
- NoteApp.jsx is gone. App.jsx now holds only where the user is; note data,
  search, layout, history and drag each live behind a hook, and the four
  panes are stateless.
- the whole data layer is TypeScript, with 81 unit tests concentrated on
  the places that have actually broken.
- fixed along the way: the browser back button had a dead press, because
  restoring a history entry pushed a duplicate one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docker-compose.dev.yml

@@ -0,0 +1,73 @@
+# ─────────────────────────────────────────────
+# InkNote — lokales Test-Setup (baut aus dem Quellcode)
+#
+# Prod-nah (nginx + gebautes Bundle) auf :3000
+#   docker compose -f docker-compose.dev.yml up -d --build
+#
+# Mit Hot-Reload-Dev-Server auf :5173 zusätzlich
+#   docker compose -f docker-compose.dev.yml --profile dev up -d --build
+#
+#   docker compose -f docker-compose.dev.yml logs -f
+#   docker compose -f docker-compose.dev.yml down
+#
+# Secrets kommen aus .env (nicht committen!)
+# Daten liegen unter ${INKNOTE_DATA_DIR:-./data} auf dem Host.
+# ─────────────────────────────────────────────
+
+services:
+  inknote-server:
+    build:
+      context: ./backend
+      dockerfile: Dockerfile
+    container_name: inknote-server-dev
+    restart: unless-stopped
+    environment:
+      - PORT=4000
+      - JWT_SECRET=${JWT_SECRET}
+      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
+      - NODE_ENV=development
+    # Bind mounts, not named volumes: the data sits in a plain directory on the
+    # Docker host where the host's own backup picks it up.
+    user: "${INKNOTE_UID:-1000}:${INKNOTE_GID:-1000}"
+    volumes:
+      - ${INKNOTE_DATA_DIR:-./data}/db:/app/data
+      - ${INKNOTE_DATA_DIR:-./data}/uploads:/app/uploads
+    healthcheck:
+      test: ["CMD", "wget", "-qO-", "http://localhost:4000/api/health"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+      start_period: 10s
+
+  inknote-web:
+    build:
+      context: ./frontend
+      dockerfile: dockerfile
+    container_name: inknote-web-dev
+    restart: unless-stopped
+    ports:
+      - "3000:80"
+    depends_on:
+      inknote-server:
+        condition: service_healthy
+
+  # Vite mit Hot-Reload — nur mit "--profile dev"
+  inknote-vite:
+    image: node:20-alpine
+    container_name: inknote-vite-dev
+    profiles: ["dev"]
+    working_dir: /app
+    command: sh -c "npm install && npm run dev"
+    environment:
+      - VITE_API_TARGET=http://inknote-server:4000
+    volumes:
+      - ./frontend:/app
+      - inknote-dev-node-modules:/app/node_modules
+    ports:
+      - "5173:5173"
+    depends_on:
+      inknote-server:
+        condition: service_healthy
+
+volumes:
+  inknote-dev-node-modules: