fix: code principles audit — correctness, security, testability

- Add rows.Err() checks after all scan loops (entities, tags, resolve)
- Surface time.Parse errors instead of silently discarding
- Extract entityRow scan helper to eliminate Get/List duplication
- Cap request body at 1MB via MaxBytesReader
- Stop leaking internal errors to API clients (log server-side only)
- Block javascript: URIs in link card open button (XSS)
- Fix all go vet failures in api_test.go (unchecked http errors)
- Add tests for display package, generateCardData, absorb-source-card
- Run go mod tidy to fix direct/indirect dep markers

internal/display/glyph_test.go

@@ -0,0 +1,80 @@
+package display
+
+import (
+	"testing"
+
+	"github.com/lerko/nib/internal/db"
+)
+
+func TestDisplayGlyph_Fluid(t *testing.T) {
+	tests := []struct {
+		glyph db.Glyph
+		want  string
+	}{
+		{db.GlyphNote, "—"},
+		{db.GlyphTodo, "○"},
+		{db.GlyphEvent, "◇"},
+	}
+	for _, tt := range tests {
+		got := DisplayGlyph(tt.glyph, nil)
+		if got != tt.want {
+			t.Errorf("DisplayGlyph(%q, nil) = %q, want %q", tt.glyph, got, tt.want)
+		}
+	}
+}
+
+func TestDisplayGlyph_Card(t *testing.T) {
+	tests := []struct {
+		cardType db.CardType
+		want     string
+	}{
+		{db.CardSnippet, "◆"},
+		{db.CardTemplate, "◈"},
+		{db.CardChecklist, "☐"},
+		{db.CardDecision, "⚖"},
+		{db.CardLink, "↗"},
+	}
+	for _, tt := range tests {
+		ct := tt.cardType
+		got := DisplayGlyph(db.GlyphNote, &ct)
+		if got != tt.want {
+			t.Errorf("DisplayGlyph(note, %q) = %q, want %q", tt.cardType, got, tt.want)
+		}
+	}
+}
+
+func TestDisplayGlyph_CardOverridesGlyph(t *testing.T) {
+	ct := db.CardSnippet
+	got := DisplayGlyph(db.GlyphTodo, &ct)
+	if got != "◆" {
+		t.Errorf("card_type should override glyph, got %q", got)
+	}
+}
+
+func TestDisplayGlyph_UnknownFallback(t *testing.T) {
+	got := DisplayGlyph(db.Glyph("unknown"), nil)
+	if got != "—" {
+		t.Errorf("unknown glyph should fall back to —, got %q", got)
+	}
+}
+
+func TestFormatID_Long(t *testing.T) {
+	got := FormatID("01HXYZ1234567890ABCDEFGH")
+	if got != "01HXYZ123456" {
+		t.Errorf("expected 12-char truncation, got %q", got)
+	}
+}
+
+func TestFormatID_Short(t *testing.T) {
+	got := FormatID("ABC")
+	if got != "ABC" {
+		t.Errorf("short ID should pass through, got %q", got)
+	}
+}
+
+func TestFormatID_Exact12(t *testing.T) {
+	got := FormatID("123456789012")
+	if got != "123456789012" {
+		t.Errorf("exact 12-char should pass through, got %q", got)
+	}
+}