Patterns on the covers, a search box that is simply there, roomier margin notes

Four small things about the shape of the app.

Covers can be patterns as well as colours — ruled paper, graph paper,
pinstripe, bands, dots, cross-hatch, linen, washes, a ledger — drawn
entirely with CSS gradient layers. No image files, nothing to upload,
crisp at any size, and offline like everything else. A cover is stored as
an index into that list, so the new ones are appended and never inserted:
renumbering would silently repaint every notebook anyone already has.

Two things the patterns taught. One idea per cover: two crossed diagonals
meant as a chevron came out as noisy plaid at the size a cover is
actually read, and were replaced with plain bands. And the grid has to
scroll — with 27 covers the dialog ran past the bottom of a laptop screen
and took the Create button with it, which a check now holds at 1440x800.

The search box in a notebook is simply there now, and the button that
used to open it is gone. A magnifying glass cost a click and having to
remember that searching was possible at all; a search box is one line and
says for itself what it does.

Margin notes went from 208x74 to 288x112 — from three short lines to
about five. Three lines is a caption, not a remark on a passage, and the
space beside the page was sitting mostly empty.

And the notebook edit dialog was still part German, and would not say
what the server's default number of versions actually is. It names it
now, read from the server rather than written into the interface: it is
set with MAX_VERSIONS_PER_NOTE, and a hardcoded "50" would quietly start
lying the day that changed.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

backend/server.js

@@ -278,6 +278,21 @@ const publicUser = (row) => ({
   preferences: readPreferences(row.preferences),
 });
 
+/**
+ * The account as it is handed to whoever just signed in as it.
+ *
+ * Carries one thing that is not about the account at all: how many versions a
+ * notebook keeps when it names no number of its own. It is sent rather than
+ * written into the interface because it is configurable —
+ * `MAX_VERSIONS_PER_NOTE` — and a dialog that said "50" would quietly start
+ * lying the day that is changed. It rides here because this is the one payload
+ * every client already fetches, on login and on restoring a session.
+ *
+ * `publicUser` stays as it is: the admin list shows *other* people's accounts,
+ * and a server-wide setting has no business being repeated on each row.
+ */
+const signedInUser = (row) => ({ ...publicUser(row), defaultMaxVersions: MAX_VERSIONS_PER_NOTE });
+
 /* Interface settings the client may store. Anything else is dropped rather than
  * kept: this column is written by the browser, so it is an input like any other,
  * and a fixed shape is what stops it becoming a place to put arbitrary data. */
@@ -653,7 +668,7 @@ app.post("/api/auth/login", rateLimitLogin, async (req, res, next) => {
 
     clearLoginAttempts(req);
     const token = jwt.sign({ userId: user.id }, JWT_SECRET, { expiresIn: "30d" });
-    res.json({ token, user: publicUser(user) });
+    res.json({ token, user: signedInUser(user) });
   } catch (err) { next(err); }
 });
 
@@ -661,7 +676,7 @@ app.post("/api/auth/login", rateLimitLogin, async (req, res, next) => {
 app.get("/api/auth/me", authMiddleware, (req, res) => {
   const user = db.prepare("SELECT * FROM users WHERE id = ?").get(req.userId);
   if (!user) return res.status(404).json({ error: "User not found" });
-  res.json(publicUser(user));
+  res.json(signedInUser(user));
 });
 
 app.put("/api/auth/profile", authMiddleware, (req, res) => {