URLs unfurl on their own, and a lone link becomes the note

Operator: *"I'd like for URLs to unfurl. To be the whole note when the note is a
single URL, and to be a compact slot on the bottom of the note when the URL is
inline. We also need to support multiple URLs in a single note."*

Less new machinery than it sounds: `unfurl.py` already fetched and parsed OG
tags, SSRF-hardened, and `note_link_previews` was already `UNIQUE(note_id, url)`
— so several URLs per note has worked at the storage layer all along. What was
missing was that it needed a button, had one size, and drew that size in the
wrong place.

**Automatic, and never in the way.** New `unfurl_queue.py` detects a body's URLs
and fetches them on a background task AFTER the note is committed. Capture speed
is the product: an unfurl is a five-second timeout against a host nobody
controls, and a note has to persist the instant someone stops typing. Scheduled
from create, from a body edit, and from a synced push — so a linked desktop or
Android client gets previews too, on its next pull. An unlinked one has no server
to ask and simply has none, which is the honest consequence of being offline.

Safe to call on every save: it re-reads what's cached and does nothing when
nothing is new. Capped at five URLs per note, silent on every failure (a link
that won't fetch isn't an error the person needs — the note is fine, the link is
still there), and it re-checks before storing, so a slow fetch can't resurrect a
preview for a URL that was deleted while it was in flight.

**Two presentations.** A note whose body is nothing but a URL renders as its
preview and nothing else — printing the raw URL under a card that already says
where it goes is saying the same thing twice, badly. Until the fetch lands, or if
it never does, the URL stands in, so the card is never blank. Anything else gets
a compact strip.

**And the strip moved.** Previews were rendered ABOVE the body, which put a
stranger's headline where the note's own first line should be — worse now that
the first line IS the note's name. They sit at the foot of the card now, under
the note's own words.

The editor's "Preview example.com" button is gone with the manual path; removing
an unwanted preview stays, and stays editor-only.

Nine tests: three on detection (order, dedupe, sentence-punctuation trimming,
non-http rejection) in the unit lane, and three in the integration lane for what
only a real database shows — the upsert landing on the right row, a second pass
fetching nothing, and a preview NOT being stored for a URL that left the body.

frontend/src/components/NoteCard.vue

@@ -68,6 +68,26 @@ const otherAttachments = computed(() => props.note.attachments.filter((a) => !a.
 // exactly, and skips parsing a body the card was never going to show.
 const PREVIEW_LINES = 8;
 
+// --- Links ------------------------------------------------------------------
+//
+// A note that is NOTHING but a URL is a link, and its preview is the whole card —
+// showing the raw URL underneath a card that already says where it goes is saying the
+// same thing twice, badly. A URL mentioned *inside* a note is a footnote to it, and
+// gets a compact strip at the bottom instead.
+//
+// Whitespace either side still counts as lone: someone pasting a link rarely trims it.
+const LONE_URL_RE = /^\s*(https?:\/\/[^\s<>"'\])]+)\s*$/;
+
+const isLoneUrl = computed(() => LONE_URL_RE.test(props.note.body) && !props.note.items.length);
+
+/** The preview for a lone-URL note — null while it is still being fetched, or if it
+ *  could never be fetched at all. */
+const loneUrlPreview = computed(() => {
+  if (!isLoneUrl.value) return null;
+  const url = props.note.body.trim();
+  return props.note.previews.find((p) => p.url === url) ?? null;
+});
+
 const bodyPreview = computed(() => {
   const lines = props.note.body.split("\n");
   if (lines.length <= PREVIEW_LINES) return props.note.body;
@@ -226,9 +246,6 @@ onBeforeUnmount(() => document.removeEventListener("mousedown", onDocMousedown))
       </span>
     </div>
 
-    <div v-if="note.previews.length" class="mb-2 flex flex-col gap-2">
-      <LinkPreview v-for="p in note.previews" :key="p.id" :preview="p" />
-    </div>
 
     <!-- One render path: every note is a body plus, maybe, checkable items.
          A focusable div rather than a <button>, because a checklist nests interactive
@@ -241,7 +258,11 @@ onBeforeUnmount(() => document.removeEventListener("mousedown", onDocMousedown))
       @click="emit('open', note)"
       @keydown.enter="emit('open', note)"
     >
-      <div v-if="note.body" class="text-sm text-neutral-700 dark:text-neutral-300">
+      <!-- A lone URL renders as its preview and nothing else. Until the fetch lands
+           — or if it never does — the URL itself stands in, so the card is never
+           blank and the link is never unreachable. -->
+      <LinkPreview v-if="loneUrlPreview" :preview="loneUrlPreview" />
+      <div v-else-if="note.body" class="text-sm text-neutral-700 dark:text-neutral-300">
         <MarkdownText :text="bodyPreview" />
       </div>
       <p
@@ -251,6 +272,13 @@ onBeforeUnmount(() => document.removeEventListener("mousedown", onDocMousedown))
         Empty note
       </p>
     </div>
+    <!-- Inline links: a compact strip at the FOOT of the card, under the note's own
+         words rather than stacked on top of them. They were above the body until
+         M13 — which put a stranger's headline where the note's first line should be. -->
+    <div v-if="!isLoneUrl && note.previews.length" class="mt-2 flex flex-col gap-1">
+      <LinkPreview v-for="p in note.previews" :key="p.id" :preview="p" compact />
+    </div>
+
     <NoteChecklist
       v-if="note.items.length"
       :class="note.body ? 'mt-2' : ''"