Replace unused vector clocks with a conflict check that works, drop the rest

The vector clocks in the server were never reached: no client sent one,
so the branch was dead and every write was a blind overwrite. Not "the
newer edit wins" — "the request that arrives last wins", which is worse:
a phone that was offline all day buries the laptop's newer work simply by
reconnecting late.

Each write now carries baseUpdatedAt, the revision it was written on top
of. If the note has moved on since, the incoming edit still wins — a
rejection would throw away what was just typed — but the state it
replaces is kept as a version marked "conflict", so both exist and the
history is where you choose. Clocks could have told a real conflict from
a device catching up, but that precision only pays off with a merge
interface, and this reuses the version history already built.

adoptRevision() stores the revision the server reports back, or the
second save in a row would be flagged as conflicting with the first.

Also removed, as agreed:
- POST /api/notes/pdf — accepted PDFs that nothing could ever read back,
  with no retrieval route and no viewer. The readme advertised "PDF
  Import & Annotation"; that claim is gone too.
- POST /api/sync — a batch endpoint the client never called.
- the tags column — notebooks, starring and search already cover it.

Columns on existing databases are left in place. Dropping them buys
nothing and is not worth touching a live database for.

Tables now have a right-click menu (editor/tableMenu.js) for rows,
columns, header and merging. It needs stopPropagation: without it the
same event reaches window, where the menu that is mounting reads it as a
click elsewhere and closes instantly — the reason the other context menus
in App.jsx already do this.

92 browser checks across seven suites, 125 unit tests.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

frontend/src/syncEngine.ts

@@ -101,8 +101,23 @@ export interface NoteUpdate {
   content?: string;
   notebookId?: string | null;
   starred?: boolean;
-  tags?: string[];
   links?: string[];
+  /**
+   * The server revision this edit was written on top of.
+   *
+   * Lets the server notice that another device saved in between, and keep the
+   * state it is about to bury as a version rather than losing it. Absent means
+   * "do not check" — used for writes that cannot conflict, like starring.
+   */
+  baseUpdatedAt?: string | null;
+}
+
+/** What `PUT /notes/:id` answers with. */
+interface UpdateResult {
+  success?: boolean;
+  updatedAt?: string;
+  /** True when another device had saved since this edit was started. */
+  conflict?: boolean;
 }
 
 /* ─── API helper ─── */
@@ -189,6 +204,34 @@ const api = {
   },
 };
 
+/**
+ * Records the revision the server ended up at after our write.
+ *
+ * Without this every later edit would keep quoting the revision the note had
+ * when it was first loaded, and the second save in a row would look like a
+ * conflict with our own first one.
+ */
+async function adoptRevision(id: string, result: UpdateResult): Promise<void> {
+  if (result?.updatedAt) {
+    const cached = await db.getNoteContent(id);
+    if (cached) {
+      await db.putNoteContent(
+        id,
+        cached.content,
+        cached.drawingData ?? null,
+        cached.drawingStrokes ?? null,
+        result.updatedAt
+      );
+    }
+  }
+  if (result?.conflict) {
+    // The other device's state is kept server-side as a version marked
+    // "conflict"; the interface points at the history rather than trying to
+    // merge two documents nobody asked it to merge.
+    notifyData("conflict", { id });
+  }
+}
+
 /* ─── Online status ─── */
 let _online = navigator.onLine;
 window.addEventListener("online", () => {
@@ -502,7 +545,7 @@ async function processEntry(entry: QueueEntry): Promise<void> {
       break;
     }
     case "updateNote":
-      await api.put(`/notes/${a.data.id}`, a.data.updates);
+      await adoptRevision(a.data.id, await api.put<UpdateResult>(`/notes/${a.data.id}`, a.data.updates));
       break;
     case "updateDrawing":
       await api.put(`/notes/${a.data.id}/drawing`, { drawingStrokes: a.data.drawingStrokes ?? null });
@@ -792,11 +835,16 @@ export async function updateNoteContent(id: string, content: string, links?: str
   notifyData("noteContent", { id });
 
   // The server cannot read the encrypted body, so outgoing links travel with it.
-  const updates: NoteUpdate = Array.isArray(links) ? { content, links } : { content };
+  // baseUpdatedAt is the revision this copy came from — see NoteUpdate.
+  const updates: NoteUpdate = Array.isArray(links)
+    ? { content, links, baseUpdatedAt: ex?.updatedAt ?? null }
+    : { content, baseUpdatedAt: ex?.updatedAt ?? null };
+
   debounce(`content_${id}`, async () => {
     if (_online && api.token && !note?._pendingCreate) {
       try {
-        await trackWrite(id, () => api.put(`/notes/${id}`, updates));
+        const r = await trackWrite(id, () => api.put<UpdateResult>(`/notes/${id}`, updates));
+        await adoptRevision(id, r);
         notifyStatus("synced");
         return;
       } catch {