fix: harden API, DB schema, and CLI safety

- Add 'reminder' to glyph CHECK constraint (was accepted by parser but
  rejected by DB)
- Default serve bind to 127.0.0.1, add --host flag for LAN access
- Validate card_data as JSON in Store.Create/Update/Promote
- Return pagination envelope {data,total,limit,offset} from list endpoint
- Append absorb breadcrumb to source entity before soft-delete
- Add Levenshtein fuzzy match to catch command typos before routing to add
- Replace DDL string-matching migrations with versioned schema_version table
- Update web UI and API tests for envelope response format

web/app.js

@@ -1247,9 +1247,9 @@
 
   async function loadEntities() {
     const params = buildListParams(0);
-    const results = await api.listEntities(params);
-    state.entities = results;
-    state.hasMore = results.length === PAGE_SIZE;
+    const resp = await api.listEntities(params);
+    state.entities = resp.data;
+    state.hasMore = (resp.offset + resp.data.length) < resp.total;
     state.selectedIndex = -1;
     renderEntityList();
     renderDetailPane();
@@ -1258,9 +1258,9 @@
 
   async function loadMore() {
     const params = buildListParams(state.entities.length);
-    const results = await api.listEntities(params);
-    state.entities = state.entities.concat(results);
-    state.hasMore = results.length === PAGE_SIZE;
+    const resp = await api.listEntities(params);
+    state.entities = state.entities.concat(resp.data);
+    state.hasMore = (resp.offset + resp.data.length) < resp.total;
     renderEntityList();
   }