URLs unfurl on their own, and a lone link becomes the note

Operator: *"I'd like for URLs to unfurl. To be the whole note when the note is a
single URL, and to be a compact slot on the bottom of the note when the URL is
inline. We also need to support multiple URLs in a single note."*

Less new machinery than it sounds: `unfurl.py` already fetched and parsed OG
tags, SSRF-hardened, and `note_link_previews` was already `UNIQUE(note_id, url)`
— so several URLs per note has worked at the storage layer all along. What was
missing was that it needed a button, had one size, and drew that size in the
wrong place.

**Automatic, and never in the way.** New `unfurl_queue.py` detects a body's URLs
and fetches them on a background task AFTER the note is committed. Capture speed
is the product: an unfurl is a five-second timeout against a host nobody
controls, and a note has to persist the instant someone stops typing. Scheduled
from create, from a body edit, and from a synced push — so a linked desktop or
Android client gets previews too, on its next pull. An unlinked one has no server
to ask and simply has none, which is the honest consequence of being offline.

Safe to call on every save: it re-reads what's cached and does nothing when
nothing is new. Capped at five URLs per note, silent on every failure (a link
that won't fetch isn't an error the person needs — the note is fine, the link is
still there), and it re-checks before storing, so a slow fetch can't resurrect a
preview for a URL that was deleted while it was in flight.

**Two presentations.** A note whose body is nothing but a URL renders as its
preview and nothing else — printing the raw URL under a card that already says
where it goes is saying the same thing twice, badly. Until the fetch lands, or if
it never does, the URL stands in, so the card is never blank. Anything else gets
a compact strip.

**And the strip moved.** Previews were rendered ABOVE the body, which put a
stranger's headline where the note's own first line should be — worse now that
the first line IS the note's name. They sit at the foot of the card now, under
the note's own words.

The editor's "Preview example.com" button is gone with the manual path; removing
an unwanted preview stays, and stays editor-only.

Nine tests: three on detection (order, dedupe, sentence-punctuation trimming,
non-http rejection) in the unit lane, and three in the integration lane for what
only a real database shows — the upsert landing on the right row, a second pass
fetching nothing, and a preview NOT being stored for a URL that left the body.

tests/test_notes.py

@@ -5,6 +5,7 @@ import pytest
 from thoughtsync.app import create_app
 from thoughtsync.common import coerce_bool, parse_dt
 from thoughtsync.models.note import NOTE_COLORS, Note
+from thoughtsync.unfurl_queue import detect_urls
 from thoughtsync.notes import (
     _attachment_ext,
     _header_filename,
@@ -386,3 +387,22 @@ def test_native_spec_roundtrip_fields():
     assert spec["created_at"].year == 2026
     assert spec["labels"] == ["x"]
     assert spec["attachments"] == [{"file": "attachments/ab/img.png", "mime": "image/png"}]
+
+
+def test_detect_urls_finds_each_link_once_in_order():
+    body = "see https://example.com/a and https://example.com/b\nand https://example.com/a again"
+    assert detect_urls(body) == ["https://example.com/a", "https://example.com/b"]
+
+
+def test_detect_urls_trims_sentence_punctuation():
+    # A URL can end in most punctuation; a SENTENCE containing one usually doesn't.
+    assert detect_urls("read https://example.com/page.") == ["https://example.com/page"]
+    assert detect_urls("(see https://example.com/x)") == ["https://example.com/x"]
+    # …but a path that legitimately ends in a slash or a dash keeps it.
+    assert detect_urls("https://example.com/dir/") == ["https://example.com/dir/"]
+
+
+def test_detect_urls_ignores_non_http():
+    assert detect_urls("ftp://example.com and mailto:a@b.c and bare example.com") == []
+    assert detect_urls(None) == []
+    assert detect_urls("") == []