fix: address code review findings across backend and frontend

Fix goroutine-unsafe ULID entropy by wrapping in LockedMonotonicReader.
Move PRAGMA foreign_keys outside transaction in v3 migration where
SQLite was silently ignoring it. Escape LIKE wildcards in link
resolution to prevent false matches. Add non-localhost binding warning,
log writeJSON encoder errors, add ?permanent=true for explicit hard
delete, preserve title/description during absorb, use millisecond
backup timestamps, add path.Clean to spaHandler. Frontend gains
checkedJSON() for resp.ok validation, consistent stopPropagation, and
shared renderCardSections() to eliminate duplicate rendering.

internal/db/db.go

@@ -56,8 +56,6 @@ func (s *Store) Backup(dst string) error {
 	return err
 }
 
-const currentSchema = 5
-
 var migrations = []func(db *sql.DB) error{
 	// v1: initial schema
 	func(db *sql.DB) error {
@@ -108,17 +106,18 @@ var migrations = []func(db *sql.DB) error{
 
 	// v3: rebuild table with CHECK constraints (card_type 'note', glyph 'reminder')
 	func(db *sql.DB) error {
+		// PRAGMA foreign_keys must be set outside a transaction (SQLite ignores it inside one)
+		if _, err := db.Exec(`PRAGMA foreign_keys = OFF`); err != nil {
+			return fmt.Errorf("migrate fk off: %w", err)
+		}
+
 		tx, err := db.Begin()
 		if err != nil {
+			db.Exec(`PRAGMA foreign_keys = ON`)
 			return err
 		}
 		defer tx.Rollback()
 
-		// Disable FK checks during rebuild to avoid dangling references
-		if _, err := tx.Exec(`PRAGMA foreign_keys = OFF`); err != nil {
-			return fmt.Errorf("migrate fk off: %w", err)
-		}
-
 		if _, err := tx.Exec(`ALTER TABLE entities RENAME TO _entities_migrate`); err != nil {
 			return fmt.Errorf("migrate rename: %w", err)
 		}
@@ -169,11 +168,14 @@ var migrations = []func(db *sql.DB) error{
 			return fmt.Errorf("migrate tags drop: %w", err)
 		}
 
-		if _, err := tx.Exec(`PRAGMA foreign_keys = ON`); err != nil {
+		if err := tx.Commit(); err != nil {
+			db.Exec(`PRAGMA foreign_keys = ON`)
+			return err
+		}
+		if _, err := db.Exec(`PRAGMA foreign_keys = ON`); err != nil {
 			return fmt.Errorf("migrate fk on: %w", err)
 		}
-
-		return tx.Commit()
+		return nil
 	},
 
 	// v4: add indexes for common query filters