fix: address code review findings across backend and frontend

Fix goroutine-unsafe ULID entropy by wrapping in LockedMonotonicReader.
Move PRAGMA foreign_keys outside transaction in v3 migration where
SQLite was silently ignoring it. Escape LIKE wildcards in link
resolution to prevent false matches. Add non-localhost binding warning,
log writeJSON encoder errors, add ?permanent=true for explicit hard
delete, preserve title/description during absorb, use millisecond
backup timestamps, add path.Clean to spaHandler. Frontend gains
checkedJSON() for resp.ok validation, consistent stopPropagation, and
shared renderCardSections() to eliminate duplicate rendering.

internal/api/entities.go

@@ -272,6 +272,20 @@ type DeleteResponse struct {
 func deleteEntity(store *db.Store) http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		id := chi.URLParam(r, "id")
+
+		if r.URL.Query().Get("permanent") == "true" {
+			if err := store.HardDelete(r.Context(), id); err != nil {
+				if err == db.ErrNotFound {
+					writeError(w, http.StatusNotFound, "not_found", "no entity with id "+id)
+					return
+				}
+				writeInternalError(w, err)
+				return
+			}
+			writeJSON(w, http.StatusOK, DeleteResponse{Result: "hard"})
+			return
+		}
+
 		result, err := store.SoftDelete(r.Context(), id)
 		if err != nil {
 			if err == db.ErrNotFound {

internal/api/helpers.go

@@ -38,7 +38,9 @@ type EntityResponse struct {
 func writeJSON(w http.ResponseWriter, status int, v any) {
 	w.Header().Set("Content-Type", "application/json")
 	w.WriteHeader(status)
-	json.NewEncoder(w).Encode(v)
+	if err := json.NewEncoder(w).Encode(v); err != nil {
+		log.Printf("writeJSON encode error: %v", err)
+	}
 }
 
 func writeError(w http.ResponseWriter, status int, code, message string) {

internal/api/router.go

@@ -47,7 +47,7 @@ func spaHandler(fsys fs.FS) http.HandlerFunc {
 	indexHTML, _ := fs.ReadFile(fsys, "index.html")
 
 	return func(w http.ResponseWriter, r *http.Request) {
-		p := r.URL.Path
+		p := path.Clean(r.URL.Path)
 		if p == "/" || path.Ext(p) == "" {
 			w.Header().Set("Content-Type", "text/html; charset=utf-8")
 			w.Write(indexHTML)