fix: comprehensive security, consistency, and dead code cleanup

Security:
- Add auth + file type/size validation to upload API
- Add admin auth to /api/admin/ endpoints
- Add SSRF protection to scrape action
- Whitelist fields in PUT /api/notes/[id] to prevent mass assignment
- Protect /lab, /agents, /chat, /canvas, /notebooks routes in middleware

AI provider fixes:
- Add deepseek/openrouter to factory ProviderType (was silently falling back to ollama)
- Fix title-suggestion.service.ts to use factory instead of hardcoded OpenAI
- Fix getAIProvider→getChatProvider in memory-echo, notebook-summary, agent-executor
- Fix getAIProvider→getTagsProvider in notebook-suggestion, title-suggestions, transform-markdown

Functional bugs:
- Fix ALLOW_REGISTRATION AND→OR logic
- Fix note-editor.tsx passing stale props to useAutoTagging instead of local state
- Fix stale Note.embedding type (migrated to NoteEmbedding table)
- Remove hardcoded SQLite path from prisma.ts

Frontend:
- Add AbortController to useAutoTagging and useTitleSuggestions hooks
- Add error rollback to optimistic UI in note-inline-editor
- Remove stale closure over notebookId/language in useAutoTagging

Cleanup:
- Rename docker-compose from keepnotes→memento
- Remove unused unstable_cache import from config.ts
- Remove dead useUndoRedo hook
- Fix TagSuggestion type (add isNewLabel, reasoning)
- Remove dead AIConfig/AIProviderType types
- Fix ghost-tags unused isEmpty var and as any cast
- Fix note-editor titleSuggestions typed as any[]

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>

memento-note/lib/ai/factory.ts

@@ -3,7 +3,7 @@ import { OllamaProvider } from './providers/ollama';
 import { CustomOpenAIProvider } from './providers/custom-openai';
 import { AIProvider } from './types';
 
-type ProviderType = 'ollama' | 'openai' | 'custom';
+type ProviderType = 'ollama' | 'openai' | 'custom' | 'deepseek' | 'openrouter';
 
 function createOllamaProvider(config: Record<string, string>, modelName: string, embeddingModelName: string): OllamaProvider {
   let baseUrl = config?.OLLAMA_BASE_URL || process.env.OLLAMA_BASE_URL
@@ -50,6 +50,18 @@ function createCustomOpenAIProvider(config: Record<string, string>, modelName: s
   return new CustomOpenAIProvider(apiKey, baseUrl, modelName, embeddingModelName);
 }
 
+function createDeepSeekProvider(config: Record<string, string>, modelName: string, embeddingModelName: string): CustomOpenAIProvider {
+  const apiKey = config?.DEEPSEEK_API_KEY || config?.CUSTOM_OPENAI_API_KEY || process.env.DEEPSEEK_API_KEY || process.env.CUSTOM_OPENAI_API_KEY || '';
+  if (!apiKey) throw new Error('DEEPSEEK_API_KEY is required when using DeepSeek provider');
+  return new CustomOpenAIProvider(apiKey, 'https://api.deepseek.com/v1', modelName, embeddingModelName);
+}
+
+function createOpenRouterProvider(config: Record<string, string>, modelName: string, embeddingModelName: string): CustomOpenAIProvider {
+  const apiKey = config?.OPENROUTER_API_KEY || config?.CUSTOM_OPENAI_API_KEY || process.env.OPENROUTER_API_KEY || process.env.CUSTOM_OPENAI_API_KEY || '';
+  if (!apiKey) throw new Error('OPENROUTER_API_KEY is required when using OpenRouter provider');
+  return new CustomOpenAIProvider(apiKey, 'https://openrouter.ai/api/v1', modelName, embeddingModelName);
+}
+
 function getProviderInstance(providerType: ProviderType, config: Record<string, string>, modelName: string, embeddingModelName: string): AIProvider {
   switch (providerType) {
     case 'ollama':
@@ -58,6 +70,10 @@ function getProviderInstance(providerType: ProviderType, config: Record<string,
       return createOpenAIProvider(config, modelName, embeddingModelName);
     case 'custom':
       return createCustomOpenAIProvider(config, modelName, embeddingModelName);
+    case 'deepseek':
+      return createDeepSeekProvider(config, modelName, embeddingModelName);
+    case 'openrouter':
+      return createOpenRouterProvider(config, modelName, embeddingModelName);
     default:
       return createOllamaProvider(config, modelName, embeddingModelName);
   }