fix: address code review findings across backend and frontend

Fix goroutine-unsafe ULID entropy by wrapping in LockedMonotonicReader.
Move PRAGMA foreign_keys outside transaction in v3 migration where
SQLite was silently ignoring it. Escape LIKE wildcards in link
resolution to prevent false matches. Add non-localhost binding warning,
log writeJSON encoder errors, add ?permanent=true for explicit hard
delete, preserve title/description during absorb, use millisecond
backup timestamps, add path.Clean to spaHandler. Frontend gains
checkedJSON() for resp.ok validation, consistent stopPropagation, and
shared renderCardSections() to eliminate duplicate rendering.

internal/db/entities.go

@@ -464,6 +464,18 @@ func (s *Store) SoftDelete(ctx context.Context, id string) (DeleteResult, error)
 	return DeletedSoft, err
 }
 
+func (s *Store) HardDelete(ctx context.Context, id string) error {
+	res, err := s.db.ExecContext(ctx, "DELETE FROM entities WHERE id = ?", id)
+	if err != nil {
+		return err
+	}
+	n, _ := res.RowsAffected()
+	if n == 0 {
+		return ErrNotFound
+	}
+	return nil
+}
+
 func (s *Store) Absorb(ctx context.Context, targetID, sourceID string) error {
 	target, err := s.Get(ctx, targetID)
 	if err != nil {
@@ -487,8 +499,18 @@ func (s *Store) Absorb(ctx context.Context, targetID, sourceID string) error {
 	now := time.Now().UTC().Format(time.RFC3339)
 	merged := target.Body + "\n" + source.Body
 
-	if _, err := tx.ExecContext(ctx, "UPDATE entities SET body = ?, modified_at = ? WHERE id = ?",
-		merged, now, targetID); err != nil {
+	title := target.Title
+	if title == nil {
+		title = source.Title
+	}
+	desc := target.Description
+	if desc == nil {
+		desc = source.Description
+	}
+
+	if _, err := tx.ExecContext(ctx,
+		"UPDATE entities SET body = ?, title = ?, description = ?, modified_at = ? WHERE id = ?",
+		merged, title, desc, now, targetID); err != nil {
 		return err
 	}