fix: comprehensive security, consistency, and dead code cleanup

Security:
- Add auth + file type/size validation to upload API
- Add admin auth to /api/admin/ endpoints
- Add SSRF protection to scrape action
- Whitelist fields in PUT /api/notes/[id] to prevent mass assignment
- Protect /lab, /agents, /chat, /canvas, /notebooks routes in middleware

AI provider fixes:
- Add deepseek/openrouter to factory ProviderType (was silently falling back to ollama)
- Fix title-suggestion.service.ts to use factory instead of hardcoded OpenAI
- Fix getAIProvider→getChatProvider in memory-echo, notebook-summary, agent-executor
- Fix getAIProvider→getTagsProvider in notebook-suggestion, title-suggestions, transform-markdown

Functional bugs:
- Fix ALLOW_REGISTRATION AND→OR logic
- Fix note-editor.tsx passing stale props to useAutoTagging instead of local state
- Fix stale Note.embedding type (migrated to NoteEmbedding table)
- Remove hardcoded SQLite path from prisma.ts

Frontend:
- Add AbortController to useAutoTagging and useTitleSuggestions hooks
- Add error rollback to optimistic UI in note-inline-editor
- Remove stale closure over notebookId/language in useAutoTagging

Cleanup:
- Rename docker-compose from keepnotes→memento
- Remove unused unstable_cache import from config.ts
- Remove dead useUndoRedo hook
- Fix TagSuggestion type (add isNewLabel, reasoning)
- Remove dead AIConfig/AIProviderType types
- Fix ghost-tags unused isEmpty var and as any cast
- Fix note-editor titleSuggestions typed as any[]

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

memento-note/components/ghost-tags.tsx

@@ -21,12 +21,6 @@ export function GhostTags({ suggestions, addedTags, isAnalyzing, onSelectTag, on
   // On filtre pour l'affichage conditionnel global, mais on garde les tags ajoutés pour l'affichage visuel "validé"
   const visibleSuggestions = suggestions;
 
-  // Show help message if not analyzing and no suggestions (but don't return null)
-  const isEmpty = !isAnalyzing && visibleSuggestions.length === 0;
-
-  // FIX: Never return null, always show something (either tags, analyzer, or help message)
-  // This ensures the help message "Tapez du contenu..." is always shown when needed
-
   return (
     <div className={cn("flex flex-wrap items-center gap-2 mt-2 min-h-[24px] transition-all duration-500", className)}>
 
@@ -47,7 +41,7 @@ export function GhostTags({ suggestions, addedTags, isAnalyzing, onSelectTag, on
         const isAdded = addedTags.some(t => t.toLowerCase() === suggestion.tag.toLowerCase());
         const colorName = getHashColor(suggestion.tag);
         const colorClasses = LABEL_COLORS[colorName];
-        const isNewLabel = (suggestion as any).isNewLabel; // Check if this is a new label suggestion
+        const isNewLabel = suggestion.isNewLabel;
 
         if (isAdded) {
             // Tag déjà ajouté : on l'affiche en mode "confirmé" statique pour ne pas perdre le focus

memento-note/components/note-editor.tsx

@@ -36,6 +36,7 @@ import { EditorImages } from './editor-images'
 import { useAutoTagging } from '@/hooks/use-auto-tagging'
 import { GhostTags } from './ghost-tags'
 import { TitleSuggestions } from './title-suggestions'
+import type { TitleSuggestion } from '@/hooks/use-title-suggestions'
 import { EditorConnectionsSection } from './editor-connections-section'
 import { ComparisonModal } from './comparison-modal'
 import { FusionModal } from './fusion-modal'
@@ -76,12 +77,11 @@ export function NoteEditor({ note, readOnly = false, onClose }: NoteEditorProps)
     setContextNotebookId(note.notebookId || null)
   }, [note.notebookId, setContextNotebookId])
 
-  // Auto-tagging hook - use note.content from props instead of local state
-  // This ensures triggering when notebookId changes (e.g., after moving note to notebook)
+  // Auto-tagging hook - use local state for live suggestions as user types
   const { suggestions, isAnalyzing } = useAutoTagging({
-    content: note.type === 'text' ? (note.content || '') : '',
-    notebookId: note.notebookId, // Pass notebookId for contextual label suggestions (IA2)
-    enabled: note.type === 'text' // Auto-tagging only for text notes
+    content: note.type === 'text' ? content : '',
+    notebookId: note.notebookId,
+    enabled: note.type === 'text'
   })
 
   // Reminder state
@@ -95,7 +95,7 @@ export function NoteEditor({ note, readOnly = false, onClose }: NoteEditorProps)
   const [linkUrl, setLinkUrl] = useState('')
 
   // Title suggestions state
-  const [titleSuggestions, setTitleSuggestions] = useState<any[]>([])
+  const [titleSuggestions, setTitleSuggestions] = useState<TitleSuggestion[]>([])
   const [isGeneratingTitles, setIsGeneratingTitles] = useState(false)
 
   // Reformulation state

memento-note/components/note-inline-editor.tsx

@@ -290,26 +290,41 @@ export function NoteInlineEditor({
 
   // ── Quick actions (pin, archive, color, delete) ───────────────────────────
   const handleTogglePin = () => {
+    const prev = note.isPinned
     startTransition(async () => {
-      // Optimitistic update
-      onChange?.(note.id, { isPinned: !note.isPinned })
-      // Call with skipRevalidation to avoid server layout refresh interfering with optimistic state
-      await updateNote(note.id, { isPinned: !note.isPinned }, { skipRevalidation: true })
-      toast.success(note.isPinned ? t('notes.unpinned') || 'Désépinglée' : t('notes.pinned') || 'Épinglée')
+      onChange?.(note.id, { isPinned: !prev })
+      try {
+        await updateNote(note.id, { isPinned: !prev }, { skipRevalidation: true })
+        toast.success(prev ? t('notes.unpinned') || 'Désépinglée' : t('notes.pinned') || 'Épinglée')
+      } catch {
+        onChange?.(note.id, { isPinned: prev })
+        toast.error(t('general.error'))
+      }
     })
   }
 
   const handleToggleArchive = () => {
     startTransition(async () => {
       onArchive?.(note.id)
-      await updateNote(note.id, { isArchived: !note.isArchived }, { skipRevalidation: true })
+      try {
+        await updateNote(note.id, { isArchived: !note.isArchived }, { skipRevalidation: true })
+      } catch {
+        // Cannot easily revert since onArchive removes from list
+        toast.error(t('general.error'))
+      }
     })
   }
 
   const handleColorChange = (color: string) => {
+    const prev = color
     startTransition(async () => {
       onChange?.(note.id, { color })
-      await updateNote(note.id, { color }, { skipRevalidation: true })
+      try {
+        await updateNote(note.id, { color }, { skipRevalidation: true })
+      } catch {
+        onChange?.(note.id, { color: prev })
+        toast.error(t('general.error'))
+      }
     })
   }