TipTap editor, version history, search, attachments — and a cleanup

The app is meant to run in daily private use now, so this pass was mostly
about the ways it could quietly lose data.

Reliability and security:
- the server no longer invents a JWT_SECRET or ENCRYPTION_KEY when one is
  missing; it refuses to start. The old fallback silently made every stored
  note unreadable after a restart.
- notes are encrypted with AES-256-GCM (v2:); existing CBC bodies still read.
- login is rate limited and compares against a dummy hash when the user does
  not exist, so timing does not reveal who is registered.
- a server response issued before a local save is never adopted. This had
  already eaten drawing strokes and note links; sync.hasPendingWrites() now
  guards every path that takes a body from the server.

Editor and features:
- TipTap replaces the contenteditable editor: tables, task lists, and links
  to other notes and notebooks, with a backlinks bar on the target.
- content format v2 ({v:2,doc}); v1 {html,tasks} bodies migrate on open.
- version history: the state before each write is snapshotted, coalesced
  into 5-minute windows, 50 versions or 90 days per note.
- full-text search runs in the client, because the server cannot read
  encrypted bodies and a server index would defeat the encryption.
- image attachments are stored by SHA-256 and deduplicated; the client
  fetches them authenticated and caches the blob, so they work offline.
- drawings are vector strokes in a fixed 1200x1600 page space and now look
  the same on every screen (0.0-0.2% deviation across four widths).
- login is by username; existing email accounts migrate automatically.

Operations:
- data lives on host bind mounts, not Docker volumes, so Proxmox Backup
  covers it. Back up .env with it — without ENCRYPTION_KEY the dump is
  unreadable.

Structure:
- NoteApp.jsx is gone. App.jsx now holds only where the user is; note data,
  search, layout, history and drag each live behind a hook, and the four
  panes are stateless.
- the whole data layer is TypeScript, with 81 unit tests concentrated on
  the places that have actually broken.
- fixed along the way: the browser back button had a dead press, because
  restoring a history entry pushed a duplicate one.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

frontend/src/types.ts

@@ -0,0 +1,147 @@
+/**
+ * The shapes that travel between the server, IndexedDB and the UI.
+ *
+ * Most bugs in this app have been shape bugs: a field that is sometimes absent,
+ * a body cached in the wrong format, a stale object adopted over a fresh one.
+ * These types exist to make that class of mistake fail at build time.
+ */
+
+/* ── Drawing ── */
+
+export type StrokeTool = "pen" | "highlighter" | "eraser";
+
+export interface Stroke {
+  /** Tool the stroke was drawn with. */
+  t: StrokeTool;
+  /** Colour, `#rrggbb`. */
+  c: string;
+  /** Width in canonical page units, not pixels. */
+  s: number;
+  /** Flat `[x0, y0, x1, y1, …]` in canonical page space. */
+  p: number[];
+}
+
+export interface StrokeDoc {
+  v: number;
+  /** Canonical page width the points are expressed in. */
+  w: number;
+  /** Canonical page height. */
+  h: number;
+  strokes: Stroke[];
+  /** Save token — lets the editor recognise its own write coming back. */
+  t?: string;
+}
+
+/* ── Notes ── */
+
+/** Note metadata, as held in the notes list. */
+export interface NoteMeta {
+  id: string;
+  title: string;
+  folderId: string | null;
+  starred: boolean;
+  trashed: boolean;
+  createdAt: string;
+  updatedAt: string;
+  /** Set while a note created offline has not reached the server yet. */
+  _pendingCreate?: boolean;
+}
+
+/** The lazily loaded body of a note. */
+export interface NoteContent {
+  /** Serialised document: `{"v":2,"doc":…}`, or a v1 `{html,tasks}` string. */
+  content: string;
+  /** Legacy raster drawing as a data URL, for notes predating vector strokes. */
+  drawingData: string | null;
+  drawingStrokes: StrokeDoc | null;
+  /** Server revision this copy came from, used to spot a stale cache. */
+  updatedAt?: string | null;
+}
+
+export interface Notebook {
+  id: string;
+  name: string;
+  cover: number;
+  sortOrder: number;
+  _pendingCreate?: boolean;
+}
+
+export interface User {
+  id: string;
+  username: string;
+  displayName: string;
+}
+
+/* ── Version history ── */
+
+export type VersionReason = "edit" | "large-deletion" | "drawing" | "drawing-cleared" | "before-restore";
+
+export interface NoteVersionSummary {
+  id: number;
+  title: string | null;
+  device_id: string | null;
+  reason: VersionReason | string;
+  created_at: string;
+  content_size: number | null;
+  has_drawing: boolean;
+}
+
+export interface NoteVersion {
+  id: number;
+  title: string | null;
+  created_at: string;
+  device_id: string | null;
+  reason: string;
+  content: string;
+  drawingStrokes: StrokeDoc | null;
+}
+
+/* ── Links ── */
+
+export interface Backlink {
+  id: string;
+  title: string;
+  notebook_id: string | null;
+  notebook_name: string | null;
+  updated_at: string;
+}
+
+export type LinkKind = "note" | "notebook";
+
+export interface LinkTarget {
+  id: string;
+  label: string;
+  kind: LinkKind;
+}
+
+/* ── Sync ── */
+
+export type SyncStatus = "synced" | "syncing" | "pending" | "offline" | "error";
+
+/** A change waiting to be pushed to the server. */
+export interface QueueEntry {
+  queueId: number;
+  action: string;
+  data: Record<string, unknown>;
+  timestamp: number;
+  attempts?: number;
+  lastError?: string;
+}
+
+/* ── Attachments ── */
+
+export interface AttachmentInfo {
+  id: string;
+  mime: string;
+  size: number;
+  deduplicated: boolean;
+}
+
+/* ── Search ── */
+
+export interface SearchHit {
+  id: string;
+  score: number;
+  /** Excerpt around the first matching term. */
+  snippet: string;
+}