TipTap editor, version history, search, attachments — and a cleanup

The app is meant to run in daily private use now, so this pass was mostly
about the ways it could quietly lose data.

Reliability and security:
- the server no longer invents a JWT_SECRET or ENCRYPTION_KEY when one is
  missing; it refuses to start. The old fallback silently made every stored
  note unreadable after a restart.
- notes are encrypted with AES-256-GCM (v2:); existing CBC bodies still read.
- login is rate limited and compares against a dummy hash when the user does
  not exist, so timing does not reveal who is registered.
- a server response issued before a local save is never adopted. This had
  already eaten drawing strokes and note links; sync.hasPendingWrites() now
  guards every path that takes a body from the server.

Editor and features:
- TipTap replaces the contenteditable editor: tables, task lists, and links
  to other notes and notebooks, with a backlinks bar on the target.
- content format v2 ({v:2,doc}); v1 {html,tasks} bodies migrate on open.
- version history: the state before each write is snapshotted, coalesced
  into 5-minute windows, 50 versions or 90 days per note.
- full-text search runs in the client, because the server cannot read
  encrypted bodies and a server index would defeat the encryption.
- image attachments are stored by SHA-256 and deduplicated; the client
  fetches them authenticated and caches the blob, so they work offline.
- drawings are vector strokes in a fixed 1200x1600 page space and now look
  the same on every screen (0.0-0.2% deviation across four widths).
- login is by username; existing email accounts migrate automatically.

Operations:
- data lives on host bind mounts, not Docker volumes, so Proxmox Backup
  covers it. Back up .env with it — without ENCRYPTION_KEY the dump is
  unreadable.

Structure:
- NoteApp.jsx is gone. App.jsx now holds only where the user is; note data,
  search, layout, history and drag each live behind a hook, and the four
  panes are stateless.
- the whole data layer is TypeScript, with 81 unit tests concentrated on
  the places that have actually broken.
- fixed along the way: the browser back button had a dead press, because
  restoring a history entry pushed a duplicate one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

frontend/src/editor/extensions.js

@@ -0,0 +1,49 @@
+/** The one place that decides which nodes and marks a note may contain. */
+
+import StarterKit from "@tiptap/starter-kit";
+import Underline from "@tiptap/extension-underline";
+import Link from "@tiptap/extension-link";
+import Placeholder from "@tiptap/extension-placeholder";
+import TaskList from "@tiptap/extension-task-list";
+import TaskItem from "@tiptap/extension-task-item";
+import Table from "@tiptap/extension-table";
+import TableRow from "@tiptap/extension-table-row";
+import TableHeader from "@tiptap/extension-table-header";
+import TableCell from "@tiptap/extension-table-cell";
+
+import { NoteLink } from "./noteLink.js";
+import { AttachmentImage } from "./attachmentImage.js";
+
+export function buildExtensions({ search = () => [], placeholder = "Start writing..." } = {}) {
+  return [
+    StarterKit.configure({
+      heading: { levels: [1, 2, 3] },
+      // History is on by default; the drawing layer keeps its own undo stack.
+      codeBlock: { HTMLAttributes: { class: "note-code-block" } },
+    }),
+    Underline,
+    Link.configure({
+      openOnClick: false, // the app decides what a click does
+      autolink: true,
+      protocols: ["http", "https", "mailto"],
+      HTMLAttributes: { rel: "noopener noreferrer nofollow", target: "_blank" },
+    }),
+    // allowBase64 stays on so notes written before attachments still render.
+    AttachmentImage.configure({ inline: false, allowBase64: true }),
+    Placeholder.configure({ placeholder }),
+    TaskList,
+    TaskItem.configure({ nested: true }),
+    Table.configure({ resizable: true, lastColumnResizable: false, allowTableNodeSelection: true }),
+    TableRow,
+    TableHeader,
+    TableCell,
+    NoteLink.configure({ search }),
+  ];
+}
+
+/**
+ * A static extension list for parsing stored HTML outside of a live editor
+ * (`generateJSON`). It must accept everything `buildExtensions` produces, or
+ * migrating an old note would silently drop nodes.
+ */
+export const parsingExtensions = buildExtensions();