fix: harden API, DB, and web layer from audit findings

- Cap list API limit at 200 to prevent unbounded queries
- Sanitize markdown output with DOMPurify to prevent XSS
- Add v4 migration with indexes on deleted_at and modified_at
- Fix v2 migration swallowed ALTER TABLE errors
- Tighten ~/.nib directory permissions to 0o700

web/app.js

@@ -1946,7 +1946,8 @@
   function renderMd(s) {
     if (!s) return '';
     if (typeof marked === 'undefined') return escHtml(s);
-    return marked.parse(s, { breaks: true });
+    const html = marked.parse(s, { breaks: true });
+    return typeof DOMPurify !== 'undefined' ? DOMPurify.sanitize(html) : escHtml(s);
   }
 
   function isSafeUrl(url) {