M6 1901: URL capture with link-preview unfurl (SSRF-hardened)

Paste a link → fetch its OpenGraph/meta preview (title, description, image,
site) and show a rich card. User-triggered + persisted (never auto-fetches;
cached so it never re-fetches). Opt-in via a new admin setting
enable_url_unfurl (default on, rule 26).

Security (the whole point of this task): a new dependency-free unfurl.py
does the fetch with layered SSRF defenses — http/https only; resolve the
host and reject EVERY non-public address (private/loopback/link-local/
reserved/multicast/unspecified — blocks 169.254.169.254 etc.); connect to
the vetted IP with SNI so DNS-rebinding can't slip through; ≤3 redirects
each re-validated; 5s timeout; 512 KB cap; text/html only; blocking IO in a
worker thread. No server-side image fetch — the og:image URL is loaded by
the browser.

- note_link_previews table (migration 0020), one per (note, url); serialized
  inline on notes (+ rides the sync pull feed read-only).
- POST /api/notes/<id>/unfurl {url} (owner-scoped, setting-gated, 502 on
  fetch failure); DELETE /api/notes/<id>/previews/<id>.
- enable_url_unfurl exposed in public config so the UI hides the affordance
  when disabled.

Frontend: LinkPreview.vue card; editor detects URLs in the body and offers a
"Preview <domain>" chip per un-previewed link (ensureDraft first), renders
preview cards with remove; card shows previews read-only. New link icon;
notes-store unfurl()/deletePreview().

Tests (DB-free): is_public_ip range blocking, validate_url scheme/parts,
extract_preview (OG + <title> fallback + relative-image resolve), endpoint
auth-guards.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

frontend/src/components/LinkPreview.vue

@@ -0,0 +1,46 @@
+<script setup lang="ts">
+import type { LinkPreview } from "../stores/notes";
+
+defineProps<{ preview: LinkPreview; removable?: boolean }>();
+defineEmits<{ (e: "remove"): void }>();
+</script>
+
+<template>
+  <div class="group/lp relative overflow-hidden rounded-lg border border-neutral-200 dark:border-neutral-700">
+    <a
+      :href="preview.url"
+      target="_blank"
+      rel="noopener noreferrer"
+      class="flex items-stretch hover:bg-neutral-50 dark:hover:bg-neutral-800/60"
+    >
+      <img
+        v-if="preview.image_url"
+        :src="preview.image_url"
+        alt=""
+        loading="lazy"
+        decoding="async"
+        class="h-auto w-24 shrink-0 self-stretch object-cover"
+      />
+      <div class="min-w-0 flex-1 px-3 py-2">
+        <p v-if="preview.site_name" class="truncate text-[11px] uppercase tracking-wide text-neutral-400">
+          {{ preview.site_name }}
+        </p>
+        <p class="truncate text-sm font-medium text-neutral-800 dark:text-neutral-100">
+          {{ preview.title || preview.url }}
+        </p>
+        <p v-if="preview.description" class="mt-0.5 line-clamp-2 text-xs text-neutral-500 dark:text-neutral-400">
+          {{ preview.description }}
+        </p>
+      </div>
+    </a>
+    <button
+      v-if="removable"
+      type="button"
+      class="absolute right-1 top-1 rounded-full bg-black/50 px-1.5 text-white opacity-0 transition group-hover/lp:opacity-100"
+      aria-label="Remove preview"
+      @click="$emit('remove')"
+    >
+      ×
+    </button>
+  </div>
+</template>