TipTap editor, version history, search, attachments — and a cleanup

The app is meant to run in daily private use now, so this pass was mostly
about the ways it could quietly lose data.

Reliability and security:
- the server no longer invents a JWT_SECRET or ENCRYPTION_KEY when one is
  missing; it refuses to start. The old fallback silently made every stored
  note unreadable after a restart.
- notes are encrypted with AES-256-GCM (v2:); existing CBC bodies still read.
- login is rate limited and compares against a dummy hash when the user does
  not exist, so timing does not reveal who is registered.
- a server response issued before a local save is never adopted. This had
  already eaten drawing strokes and note links; sync.hasPendingWrites() now
  guards every path that takes a body from the server.

Editor and features:
- TipTap replaces the contenteditable editor: tables, task lists, and links
  to other notes and notebooks, with a backlinks bar on the target.
- content format v2 ({v:2,doc}); v1 {html,tasks} bodies migrate on open.
- version history: the state before each write is snapshotted, coalesced
  into 5-minute windows, 50 versions or 90 days per note.
- full-text search runs in the client, because the server cannot read
  encrypted bodies and a server index would defeat the encryption.
- image attachments are stored by SHA-256 and deduplicated; the client
  fetches them authenticated and caches the blob, so they work offline.
- drawings are vector strokes in a fixed 1200x1600 page space and now look
  the same on every screen (0.0-0.2% deviation across four widths).
- login is by username; existing email accounts migrate automatically.

Operations:
- data lives on host bind mounts, not Docker volumes, so Proxmox Backup
  covers it. Back up .env with it — without ENCRYPTION_KEY the dump is
  unreadable.

Structure:
- NoteApp.jsx is gone. App.jsx now holds only where the user is; note data,
  search, layout, history and drag each live behind a hook, and the four
  panes are stateless.
- the whole data layer is TypeScript, with 81 unit tests concentrated on
  the places that have actually broken.
- fixed along the way: the browser back button had a dead press, because
  restoring a history entry pushed a duplicate one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

frontend/src/main.jsx

@@ -1,14 +1,17 @@
-import React from 'react'
-import ReactDOM from 'react-dom/client'
-import NoteApp from './NoteApp.jsx'
+import React from "react";
+import ReactDOM from "react-dom/client";
+import NoteApp from "./App.jsx";
 
 // Hide splash screen
 const hideSplash = () => {
-  const splash = document.getElementById('splash');
-  if (splash) { splash.classList.add('hide'); setTimeout(() => splash.remove(), 300); }
+  const splash = document.getElementById("splash");
+  if (splash) {
+    splash.classList.add("hide");
+    setTimeout(() => splash.remove(), 300);
+  }
 };
 
-ReactDOM.createRoot(document.getElementById('root')).render(
+ReactDOM.createRoot(document.getElementById("root")).render(
   <React.StrictMode>
     <NoteApp />
   </React.StrictMode>
@@ -17,17 +20,17 @@ ReactDOM.createRoot(document.getElementById('root')).render(
 setTimeout(hideSplash, 200);
 
 // Register service worker
-if ('serviceWorker' in navigator) {
-  window.addEventListener('load', async () => {
+if ("serviceWorker" in navigator) {
+  window.addEventListener("load", async () => {
     try {
       // Use the page's base URL as scope so it works behind any reverse proxy path
-      const swUrl = new URL('./sw.js', window.location.href).href;
-      const scope = new URL('./', window.location.href).href;
+      const swUrl = new URL("./sw.js", window.location.href).href;
+      const scope = new URL("./", window.location.href).href;
       const reg = await navigator.serviceWorker.register(swUrl, { scope });
-      console.log('[SW] Registered, scope:', reg.scope);
+      console.log("[SW] Registered, scope:", reg.scope);
       setInterval(() => reg.update(), 60 * 60 * 1000);
     } catch (err) {
-      console.warn('[SW] Registration failed:', err);
+      console.warn("[SW] Registration failed:", err);
     }
   });
-}
+}