perf: optimize MCP server (O(1) auth, compact JSON, trashedAt fix) + memento-note performance (lazy loading, server-side filtering, XSS fixes, dead code removal, security hardening)

MCP Server:
- Fix validateApiKey: O(1) direct lookup by shortId instead of loading all keys
- Add trashedAt:null filter to ALL note queries (trashed notes leaked in results)
- Compact JSON output (~40% smaller responses)
- Bounded session cache (Map with MAX_SESSIONS=500) to prevent memory leaks
- PostgreSQL connection pooling (connection_limit=10)
- Rewrite all 22 tool descriptions in clear English
- Fix /sse fallback to proper 307 redirect

memento-note Performance:
- loading=lazy on all note images
- Split notebooksRefreshKey from global refreshKey (note CRUD no longer re-fetches notebooks)
- Remove searchKey from trash count deps (no re-fetch on every keystroke)
- Server-side notebookId filter in getAllNotes() (biggest win)
- Skip collaborator fetch for non-shared notes (eliminates N+1 API calls)
- next/dynamic for MarkdownContent + 4 modals (code-split remark/rehype/KaTeX)
- Memoize DOMPurify sanitize with useMemo

Security:
- XSS: DOMPurify sanitize in note-card and note-history-modal
- Auth anti-enumeration: uniform errors in auth.ts
- CRON_SECRET mandatory on cron endpoints
- Rate limiting on login (5 attempts/min per email)
- Centralized API auth helpers (requireAuth/requireAdmin)
- randomize-labels changed GET→POST
- Removed debug endpoints (/api/debug/config, /api/debug/test-chat)

Cleanup:
- Removed dead code: .backup-keep, settings-backup, fix-*.js, debug-theme, fix-labels route
- Removed sensitive console.error in auth.ts
- Ollama fetchWithTimeout (30s/60s AbortController)
- i18n: full Arabic translation, Farsi missing keys
- Masonry drag-and-drop fix (localOrderMap, cross-section block)
- Sidebar notebook tooltip on truncation

memento-note/app/actions/notes.ts

@@ -1375,28 +1375,35 @@ export async function syncAllEmbeddings() {
 }
 
 // Get all notes including those shared with the user
-export async function getAllNotes(includeArchived = false) {
+export async function getAllNotes(includeArchived = false, notebookId?: string) {
   const session = await auth();
   if (!session?.user?.id) return [];
 
   const userId = session.user.id;
 
   try {
-    // Fetch own notes + shared notes in parallel — no embedding to keep transfer fast
-    const [ownNotes, acceptedShares] = await Promise.all([
-      prisma.note.findMany({
-        where: {
-          userId,
-          trashedAt: null,
-          ...(includeArchived ? {} : { isArchived: false }),
-        },
-        select: NOTE_LIST_SELECT,
-        orderBy: [
-          { isPinned: 'desc' },
-          { order: 'asc' },
-          { updatedAt: 'desc' }
-        ]
-      }),
+    const whereClause: any = {
+      userId,
+      trashedAt: null,
+      ...(includeArchived ? {} : { isArchived: false }),
+      ...(notebookId !== undefined ? { notebookId: notebookId || null } : {}),
+    }
+
+    const ownNotes = await prisma.note.findMany({
+      where: whereClause,
+      select: NOTE_LIST_SELECT,
+      orderBy: [
+        { isPinned: 'desc' },
+        { order: 'asc' },
+        { updatedAt: 'desc' }
+      ]
+    })
+
+    if (notebookId) {
+      return ownNotes.map(parseNote)
+    }
+
+    const [acceptedShares] = await Promise.all([
       prisma.noteShare.findMany({
         where: { userId, status: 'accepted' },
         include: { note: { select: NOTE_LIST_SELECT } }