fix(audit): sécurité + perf + DB — 40 problèmes adressés

SÉCURITÉ (CRITIQUE):
- link-preview: auth() obligatoire + filtre IP privées (SSRF fix)
- metrics: !metricsToken → 401 au lieu d'etre ouvert si token absent
- contextual-ai-chat: DOMPurify.sanitize() sur dangerouslySetInnerHTML (XSS fix)

PERFORMANCE:
- graph/route.ts: take:500 + orderBy updatedAt desc (pas de full table scan)
- syncAllEmbeddings: batch parallèle Promise.allSettled × 5 (pas séquentiel)
- 80 console.log supprimés du code production

BASE DE DONNÉES:
- Note: index contentUpdatedAt + isPublic ajoutés au schema
- DocumentChunk: commentaire index vectoriel HNSW (à exécuter manuellement)

memento-note/lib/ai/tools/excalidraw.tool.ts

@@ -1128,8 +1128,6 @@ RULES:
       }),
       execute: async ({ title, diagram }) => {
         try {
-          console.log('[Excalidraw Tool] INPUT title:', title)
-          console.log('[Excalidraw Tool] INPUT diagram (first 500):', diagram?.substring(0, 500))
 
           let elements: any[]
           let effectiveTitle = title
@@ -1169,8 +1167,6 @@ RULES:
             elements = built.elements
             appliedStyle = style
             appliedType = effectiveType
-            console.log('[Excalidraw Tool] Graph sanitize metrics:', sanitized.metrics)
-            console.log('[Excalidraw Tool] Layout quality:', { ...built.layoutQuality, rankdir: built.rankdir, engine: built.engine, style, forcedAgentStyle, diagramType: effectiveType, zones: zones.length })
           } else if (parsed.elements && Array.isArray(parsed.elements)) {
             elements = parsed.elements.map((el: any, i: number) => normalizeElement(el, i))
             effectiveTitle = parsed.title || title || 'Diagram'
@@ -1186,7 +1182,6 @@ RULES:
             return { success: false, error: 'No elements in diagram.' }
           }
 
-          console.log('[Excalidraw Tool] Elements count:', elements.length, '| Types:', [...new Set(elements.map((e: any) => e.type))])
 
           const canvas = await prisma.canvas.create({
             data: {
@@ -1202,7 +1197,6 @@ RULES:
             },
           })
 
-          console.log('[Excalidraw Tool] Canvas created:', canvas.id, canvas.name)
 
           // Immediately mark the AgentAction as success so frontend polling unblocks
           if (ctx.actionId) {