fix: harden API, DB, and web layer from audit findings

- Cap list API limit at 200 to prevent unbounded queries
- Sanitize markdown output with DOMPurify to prevent XSS
- Add v4 migration with indexes on deleted_at and modified_at
- Fix v2 migration swallowed ALTER TABLE errors
- Tighten ~/.nib directory permissions to 0o700

internal/api/entities.go

@@ -92,6 +92,9 @@ func listEntities(store *db.Store) http.HandlerFunc {
 				writeError(w, http.StatusBadRequest, "invalid_input", "limit must be a positive integer")
 				return
 			}
+			if limit > 200 {
+				limit = 200
+			}
 			p.Limit = limit
 		}
 		if offsetStr := r.URL.Query().Get("offset"); offsetStr != "" {