fix(audit): sécurité + perf + DB — 40 problèmes adressés

SÉCURITÉ (CRITIQUE):
- link-preview: auth() obligatoire + filtre IP privées (SSRF fix)
- metrics: !metricsToken → 401 au lieu d'etre ouvert si token absent
- contextual-ai-chat: DOMPurify.sanitize() sur dangerouslySetInnerHTML (XSS fix)

PERFORMANCE:
- graph/route.ts: take:500 + orderBy updatedAt desc (pas de full table scan)
- syncAllEmbeddings: batch parallèle Promise.allSettled × 5 (pas séquentiel)
- 80 console.log supprimés du code production

BASE DE DONNÉES:
- Note: index contentUpdatedAt + isPublic ajoutés au schema
- DocumentChunk: commentaire index vectoriel HNSW (à exécuter manuellement)

memento-note/app/api/canvas/slides/pptx/route.ts

@@ -75,7 +75,6 @@ async function buildPptx(spec: any): Promise<Buffer> {
       }
 
       case 'bullets': {
-        console.log('[PPTX] Rendering bullets slide:', slide.title, 'items:', slide.items?.length)
         s.background = { color: p.bg }
         s.addShape(pptx.ShapeType.rect, {
           x: 0, y: 0, w: 0.06, h: H,
@@ -90,7 +89,6 @@ async function buildPptx(spec: any): Promise<Buffer> {
           fill: { color: p.accent }, line: { type: 'none' },
         })
         const items = slide.items ?? []
-        console.log('[PPTX] Bullet items:', items.length, items[0])
         // Use simpler bullet format - each item as separate text call with bullet option
         items.forEach((item: string, i: number) => {
           s.addText(item, {

memento-note/app/api/canvas/slides/route.ts

@@ -4,10 +4,8 @@ import { prisma } from '@/lib/prisma'
 export async function GET(req: NextRequest) {
   try {
     const canvasId = req.nextUrl.searchParams.get('id')
-    console.log('[Slides API] Request for id:', canvasId)
 
     if (!canvasId) {
-      console.log('[Slides API] ERROR: Missing id')
       return new Response(JSON.stringify({ error: 'Missing id' }), {
         status: 400,
         headers: { 'Content-Type': 'application/json' },
@@ -19,39 +17,31 @@ export async function GET(req: NextRequest) {
     })
 
     if (!canvas) {
-      console.log('[Slides API] ERROR: Canvas not found for id:', canvasId)
       return new Response(JSON.stringify({ error: 'Not found' }), {
         status: 404,
         headers: { 'Content-Type': 'application/json' },
       })
     }
 
-    console.log('[Slides API] Canvas found:', canvas.name, '| data length:', canvas.data?.length)
-    console.log('[Slides API] Raw data start:', canvas.data?.substring(0, 200))
 
     let parsed: any
     try {
       parsed = JSON.parse(canvas.data)
     } catch (parseErr) {
-      console.log('[Slides API] ERROR: JSON parse failed:', parseErr)
       return new Response(JSON.stringify({ error: 'Invalid data' }), {
         status: 500,
         headers: { 'Content-Type': 'application/json' },
       })
     }
 
-    console.log('[Slides API] Parsed type:', parsed.type, '| has html:', !!parsed.html, '| html length:', parsed.html?.length)
-    console.log('[Slides API] HTML start:', parsed.html?.substring(0, 150))
 
     if (parsed.type !== 'slides' || !parsed.html) {
-      console.log('[Slides API] ERROR: Not a slides canvas. type:', parsed.type, 'html exists:', !!parsed.html)
       return new Response(JSON.stringify({ error: 'Not a slides canvas' }), {
         status: 400,
         headers: { 'Content-Type': 'application/json' },
       })
     }
 
-    console.log('[Slides API] SUCCESS: Returning HTML, length:', parsed.html.length)
 
     return new Response(parsed.html, {
       status: 200,