fix: comprehensive security, consistency, and dead code cleanup

Security:
- Add auth + file type/size validation to upload API
- Add admin auth to /api/admin/ endpoints
- Add SSRF protection to scrape action
- Whitelist fields in PUT /api/notes/[id] to prevent mass assignment
- Protect /lab, /agents, /chat, /canvas, /notebooks routes in middleware

AI provider fixes:
- Add deepseek/openrouter to factory ProviderType (was silently falling back to ollama)
- Fix title-suggestion.service.ts to use factory instead of hardcoded OpenAI
- Fix getAIProvider→getChatProvider in memory-echo, notebook-summary, agent-executor
- Fix getAIProvider→getTagsProvider in notebook-suggestion, title-suggestions, transform-markdown

Functional bugs:
- Fix ALLOW_REGISTRATION AND→OR logic
- Fix note-editor.tsx passing stale props to useAutoTagging instead of local state
- Fix stale Note.embedding type (migrated to NoteEmbedding table)
- Remove hardcoded SQLite path from prisma.ts

Frontend:
- Add AbortController to useAutoTagging and useTitleSuggestions hooks
- Add error rollback to optimistic UI in note-inline-editor
- Remove stale closure over notebookId/language in useAutoTagging

Cleanup:
- Rename docker-compose from keepnotes→memento
- Remove unused unstable_cache import from config.ts
- Remove dead useUndoRedo hook
- Fix TagSuggestion type (add isNewLabel, reasoning)
- Remove dead AIConfig/AIProviderType types
- Fix ghost-tags unused isEmpty var and as any cast
- Fix note-editor titleSuggestions typed as any[]

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

memento-note/lib/ai/factory.ts

@@ -3,7 +3,7 @@ import { OllamaProvider } from './providers/ollama';
 import { CustomOpenAIProvider } from './providers/custom-openai';
 import { AIProvider } from './types';
 
-type ProviderType = 'ollama' | 'openai' | 'custom';
+type ProviderType = 'ollama' | 'openai' | 'custom' | 'deepseek' | 'openrouter';
 
 function createOllamaProvider(config: Record<string, string>, modelName: string, embeddingModelName: string): OllamaProvider {
   let baseUrl = config?.OLLAMA_BASE_URL || process.env.OLLAMA_BASE_URL
@@ -50,6 +50,18 @@ function createCustomOpenAIProvider(config: Record<string, string>, modelName: s
   return new CustomOpenAIProvider(apiKey, baseUrl, modelName, embeddingModelName);
 }
 
+function createDeepSeekProvider(config: Record<string, string>, modelName: string, embeddingModelName: string): CustomOpenAIProvider {
+  const apiKey = config?.DEEPSEEK_API_KEY || config?.CUSTOM_OPENAI_API_KEY || process.env.DEEPSEEK_API_KEY || process.env.CUSTOM_OPENAI_API_KEY || '';
+  if (!apiKey) throw new Error('DEEPSEEK_API_KEY is required when using DeepSeek provider');
+  return new CustomOpenAIProvider(apiKey, 'https://api.deepseek.com/v1', modelName, embeddingModelName);
+}
+
+function createOpenRouterProvider(config: Record<string, string>, modelName: string, embeddingModelName: string): CustomOpenAIProvider {
+  const apiKey = config?.OPENROUTER_API_KEY || config?.CUSTOM_OPENAI_API_KEY || process.env.OPENROUTER_API_KEY || process.env.CUSTOM_OPENAI_API_KEY || '';
+  if (!apiKey) throw new Error('OPENROUTER_API_KEY is required when using OpenRouter provider');
+  return new CustomOpenAIProvider(apiKey, 'https://openrouter.ai/api/v1', modelName, embeddingModelName);
+}
+
 function getProviderInstance(providerType: ProviderType, config: Record<string, string>, modelName: string, embeddingModelName: string): AIProvider {
   switch (providerType) {
     case 'ollama':
@@ -58,6 +70,10 @@ function getProviderInstance(providerType: ProviderType, config: Record<string,
       return createOpenAIProvider(config, modelName, embeddingModelName);
     case 'custom':
       return createCustomOpenAIProvider(config, modelName, embeddingModelName);
+    case 'deepseek':
+      return createDeepSeekProvider(config, modelName, embeddingModelName);
+    case 'openrouter':
+      return createOpenRouterProvider(config, modelName, embeddingModelName);
     default:
       return createOllamaProvider(config, modelName, embeddingModelName);
   }

memento-note/lib/ai/services/agent-executor.service.ts

@@ -8,7 +8,7 @@
 
 import { prisma } from '@/lib/prisma'
 import { getSystemConfig } from '@/lib/config'
-import { getChatProvider, getAIProvider } from '@/lib/ai/factory'
+import { getChatProvider } from '@/lib/ai/factory'
 import { rssService } from './rss.service'
 import { toolRegistry } from '../tools'
 import { sendEmail } from '@/lib/mail'
@@ -56,7 +56,7 @@ const TITLE_PROMPTS: Record<Lang, string> = {
 async function generateTitle(content: string, agentName: string, lang: Lang): Promise<string> {
   try {
     const sysConfig = await getSystemConfig()
-    const provider = getAIProvider(sysConfig)
+    const provider = getChatProvider(sysConfig)
     const prompt = `${TITLE_PROMPTS[lang]}${content.substring(0, 800)}`
     const title = await provider.generateText(prompt)
     return title.trim().replace(/^["']|["']$/g, '').substring(0, 80)
@@ -297,7 +297,7 @@ async function executeScraperAgent(
     return { success: false, actionId, error: msg }
   }
 
-  const provider = getAIProvider(sysConfig)
+  const provider = getChatProvider(sysConfig)
   const combinedContent = scrapedParts.join('\n\n---\n\n')
 
   // Extract images BEFORE generating summary so AI can embed them
@@ -368,7 +368,7 @@ async function executeResearcherAgent(
   const topic = agent.description || agent.name
 
   const sysConfig = await getSystemConfig()
-  const provider = getAIProvider(sysConfig)
+  const provider = getChatProvider(sysConfig)
 
   const queryPrompt = lang === 'fr'
     ? `Tu es un assistant de recherche. Pour le sujet suivant, génère 3 requêtes de recherche web pertinentes (une par ligne, sans numérotation):\n\nSujet: ${topic}`
@@ -503,7 +503,7 @@ async function executeMonitorAgent(
   }
 
   const sysConfig = await getSystemConfig()
-  const provider = getAIProvider(sysConfig)
+  const provider = getChatProvider(sysConfig)
   const dateLocale = lang === 'fr' ? 'fr-FR' : 'en-US'
   const untitled = lang === 'fr' ? 'Sans titre' : 'Untitled'
 
@@ -562,7 +562,7 @@ async function executeCustomAgent(
   lang: Lang
 ): Promise<AgentExecutionResult> {
   const sysConfig = await getSystemConfig()
-  const provider = getAIProvider(sysConfig)
+  const provider = getChatProvider(sysConfig)
 
   let inputContent = ''
   const urls: string[] = agent.sourceUrls ? JSON.parse(agent.sourceUrls) : []

memento-note/lib/ai/services/memory-echo.service.ts

@@ -1,4 +1,4 @@
-import { getAIProvider } from '../factory'
+import { getAIProvider, getChatProvider } from '../factory'
 import { cosineSimilarity } from '@/lib/utils'
 import { getSystemConfig } from '@/lib/config'
 import prisma from '@/lib/prisma'
@@ -216,7 +216,7 @@ export class MemoryEchoService {
   ): Promise<string> {
     try {
       const config = await getSystemConfig()
-      const provider = getAIProvider(config)
+      const provider = getChatProvider(config)
 
       const note1Desc = note1Title || 'Untitled note'
       const note2Desc = note2Title || 'Untitled note'

memento-note/lib/ai/services/notebook-suggestion.service.ts

@@ -1,5 +1,5 @@
 import { prisma } from '@/lib/prisma'
-import { getAIProvider } from '@/lib/ai/factory'
+import { getTagsProvider } from '@/lib/ai/factory'
 import { getSystemConfig } from '@/lib/config'
 import type { Notebook } from '@/lib/types'
 
@@ -33,7 +33,7 @@ export class NotebookSuggestionService {
     // 3. Call AI
     try {
       const config = await getSystemConfig()
-      const provider = getAIProvider(config)
+      const provider = getTagsProvider(config)
 
       const response = await provider.generateText(prompt)
 

memento-note/lib/ai/services/notebook-summary.service.ts

@@ -1,5 +1,5 @@
 import { prisma } from '@/lib/prisma'
-import { getAIProvider } from '@/lib/ai/factory'
+import { getChatProvider } from '@/lib/ai/factory'
 import { getSystemConfig } from '@/lib/config'
 
 export interface NotebookSummary {
@@ -127,7 +127,7 @@ ${content}...`
 
     try {
       const config = await getSystemConfig()
-      const provider = getAIProvider(config)
+      const provider = getChatProvider(config)
       const summary = await provider.generateText(prompt)
       return summary.trim()
     } catch (error) {

memento-note/lib/ai/services/title-suggestion.service.ts

@@ -3,20 +3,10 @@
  * Generates intelligent title suggestions based on note content
  */
 
-import { createOpenAI } from '@ai-sdk/openai'
 import { generateText } from 'ai'
 import { LanguageDetectionService } from './language-detection.service'
-
-// Helper to get AI model for text generation
-function getTextGenerationModel() {
-  const apiKey = process.env.OPENAI_API_KEY
-  if (!apiKey) {
-    throw new Error('OPENAI_API_KEY not configured for title generation')
-  }
-
-  const openai = createOpenAI({ apiKey })
-  return openai('gpt-4o-mini')
-}
+import { getTagsProvider } from '../factory'
+import { getSystemConfig } from '@/lib/config'
 
 export interface TitleSuggestion {
   title: string
@@ -40,7 +30,9 @@ export class TitleSuggestionService {
     const { language: contentLanguage } = await this.languageDetection.detectLanguage(noteContent)
 
     try {
-      const model = getTextGenerationModel()
+      const config = await getSystemConfig()
+      const provider = getTagsProvider(config)
+      const model = provider.getModel()
 
       // System prompt - explains what to do
       const systemPrompt = `You are an expert title generator for a note-taking application.

memento-note/lib/ai/types.ts

@@ -1,11 +1,14 @@
 export interface TagSuggestion {
   tag: string;
   confidence: number;
+  reasoning?: string;
+  isNewLabel?: boolean;
 }
 
 export interface TitleSuggestion {
   title: string;
   confidence: number;
+  reasoning?: string;
 }
 
 export interface ToolUseOptions {
@@ -64,12 +67,4 @@ export interface AIProvider {
   generateWithTools(options: ToolUseOptions): Promise<ToolCallResult>;
 }
 
-export type AIProviderType = 'openai' | 'ollama';
-
-export interface AIConfig {
-  provider: AIProviderType;
-  apiKey?: string;
-  baseUrl?: string; // Used for Ollama
-  model?: string;
-  embeddingModel?: string;
-}
+export type AIProviderType = 'openai' | 'ollama' | 'custom' | 'deepseek' | 'openrouter';