UI polish pass: word count, slash commands, task lists, graph peek, bulk delete, export

- WordCount component (toggle words/chars vs read time, persisted mode)
- TipTap: TaskList/TaskItem extensions, slash command menu (H1-H3, lists, code, quote, task)
- Markdown serializer: task list → `- [ ]` / `- [x]` roundtrip
- GraphView: slide-in peek panel for note/task nodes (body, tags, linked nodes); tag nodes still navigate
- ChatView: bulk-select conversations with two-click confirm delete + chat retention policy (default 90d)
- NoteEditorView: pill tab bar with animated edit/preview toggle + WordCount in toolbar
- WorkspaceNoteEditor: inline search with tag matching, inline new-note creation, WordCount
- WorkspaceTaskPanel: task body rendered in slide-over + Edit link
- Settings: data export (Markdown ZIP / JSON) via GET /api/export
- Accessibility: skip-to-content link, aria-labels on all icon-only buttons
- Fix: export route used non-existent fabledassistant.database — corrected to async_session()
- Fix: ToolCallRecord.status type now includes "running" (was causing TS build error)
- Dockerfile: upgrade npm to latest before install to suppress major-version notice
- npm audit fix: patched minimatch (ReDoS) and rollup (path traversal) — 0 vulnerabilities

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/fabledassistant/routes/chat.py

@@ -10,6 +10,8 @@ from fabledassistant.routes.utils import not_found
 from fabledassistant.config import Config
 from fabledassistant.services.chat import (
     add_message,
+    bulk_delete_conversations,
+    cleanup_old_conversations,
     create_conversation,
     delete_conversation,
     get_conversation,
@@ -38,6 +40,14 @@ async def list_conversations_route():
     uid = get_current_user_id()
     limit = min(request.args.get("limit", 50, type=int), 500)
     offset = request.args.get("offset", 0, type=int)
+    # Apply retention policy before returning list
+    retention_str = await get_setting(uid, "chat_retention_days", "90")
+    try:
+        retention_days = int(retention_str)
+    except (ValueError, TypeError):
+        retention_days = 90
+    if retention_days > 0:
+        await cleanup_old_conversations(uid, retention_days)
     conversations, total = await list_conversations(uid, limit=limit, offset=offset)
     return jsonify({
         "conversations": conversations,
@@ -45,6 +55,18 @@ async def list_conversations_route():
     })
 
 
+@chat_bp.route("/conversations/bulk-delete", methods=["POST"])
+@login_required
+async def bulk_delete_conversations_route():
+    uid = get_current_user_id()
+    data = await request.get_json()
+    ids = data.get("ids", []) if isinstance(data, dict) else []
+    if not isinstance(ids, list) or not all(isinstance(i, int) for i in ids):
+        return jsonify({"error": "ids must be a list of integers"}), 400
+    count = await bulk_delete_conversations(uid, ids)
+    return jsonify({"deleted": count})
+
+
 @chat_bp.route("/conversations", methods=["POST"])
 @login_required
 async def create_conversation_route():