feat: add slides generation tool with multiple slide types

- Add slides.tool.ts with support for title, bullets, chart, stats, table, cards, timeline, quote, comparison, equation, image, summary slide types
- Chart types: bar, horizontal-bar, line, donut, radar
- Integrate with agent executor and canvas system
- Add multilingual support (en/fr)
- Various UI improvements and bug fixes

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

memento-note/app/api/labels/route.ts

@@ -1,6 +1,8 @@
 import { NextRequest, NextResponse } from 'next/server'
+import { Prisma } from '@prisma/client'
 import prisma from '@/lib/prisma'
 import { auth } from '@/auth'
+import { CreateLabelSchema } from '@/lib/validators'
 
 const COLORS = ['red', 'orange', 'yellow', 'green', 'teal', 'blue', 'purple', 'pink', 'gray'];
 
@@ -12,11 +14,10 @@ export async function GET(request: NextRequest) {
   }
 
   try {
-    const searchParams = request.nextUrl.searchParams
-    const notebookId = searchParams.get('notebookId')
+    const notebookId = request.nextUrl.searchParams.get('notebookId')
 
-    // Build where clause
-    const where: any = {}
+    // userId is always required — prevents reading another user's labels by notebookId
+    const where: Prisma.LabelWhereInput = { userId: session.user.id }
 
     if (notebookId === 'null' || notebookId === '') {
       // Get labels without a notebook (backward compatibility)
@@ -24,9 +25,6 @@ export async function GET(request: NextRequest) {
     } else if (notebookId) {
       // Get labels for a specific notebook
       where.notebookId = notebookId
-    } else {
-      // Get all labels for the user
-      where.userId = session.user.id
     }
 
     const labels = await prisma.label.findMany({
@@ -61,21 +59,14 @@ export async function POST(request: NextRequest) {
 
   try {
     const body = await request.json()
-    const { name, color, notebookId } = body
-
-    if (!name || typeof name !== 'string') {
+    const parsed = CreateLabelSchema.safeParse(body)
+    if (!parsed.success) {
       return NextResponse.json(
-        { success: false, error: 'Label name is required' },
-        { status: 400 }
-      )
-    }
-
-    if (!notebookId || typeof notebookId !== 'string') {
-      return NextResponse.json(
-        { success: false, error: 'notebookId is required' },
+        { success: false, error: 'Invalid request body', details: parsed.error.flatten() },
         { status: 400 }
       )
     }
+    const { name, color, notebookId } = parsed.data
 
     // Verify notebook ownership
     const notebook = await prisma.notebook.findUnique({