perf: optimize MCP server (O(1) auth, compact JSON, trashedAt fix) + memento-note performance (lazy loading, server-side filtering, XSS fixes, dead code removal, security hardening)

MCP Server:
- Fix validateApiKey: O(1) direct lookup by shortId instead of loading all keys
- Add trashedAt:null filter to ALL note queries (trashed notes leaked in results)
- Compact JSON output (~40% smaller responses)
- Bounded session cache (Map with MAX_SESSIONS=500) to prevent memory leaks
- PostgreSQL connection pooling (connection_limit=10)
- Rewrite all 22 tool descriptions in clear English
- Fix /sse fallback to proper 307 redirect

memento-note Performance:
- loading=lazy on all note images
- Split notebooksRefreshKey from global refreshKey (note CRUD no longer re-fetches notebooks)
- Remove searchKey from trash count deps (no re-fetch on every keystroke)
- Server-side notebookId filter in getAllNotes() (biggest win)
- Skip collaborator fetch for non-shared notes (eliminates N+1 API calls)
- next/dynamic for MarkdownContent + 4 modals (code-split remark/rehype/KaTeX)
- Memoize DOMPurify sanitize with useMemo

Security:
- XSS: DOMPurify sanitize in note-card and note-history-modal
- Auth anti-enumeration: uniform errors in auth.ts
- CRON_SECRET mandatory on cron endpoints
- Rate limiting on login (5 attempts/min per email)
- Centralized API auth helpers (requireAuth/requireAdmin)
- randomize-labels changed GET→POST
- Removed debug endpoints (/api/debug/config, /api/debug/test-chat)

Cleanup:
- Removed dead code: .backup-keep, settings-backup, fix-*.js, debug-theme, fix-labels route
- Removed sensitive console.error in auth.ts
- Ollama fetchWithTimeout (30s/60s AbortController)
- i18n: full Arabic translation, Farsi missing keys
- Masonry drag-and-drop fix (localOrderMap, cross-section block)
- Sidebar notebook tooltip on truncation

memento-note/app/api/debug/client-error/route.ts

@@ -1,12 +1,17 @@
 import { NextRequest, NextResponse } from 'next/server'
+import { auth } from '@/auth'
 
 export async function POST(request: NextRequest) {
+  const session = await auth()
+  if (!session?.user?.id) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
   try {
     const body = await request.json()
-    // Visible directement dans `docker logs memento-web`
     console.error('[CLIENT-ERROR-REPORT]', JSON.stringify(body, null, 2))
   } catch {
-    // ignore
+    // ignore malformed payload
   }
   return NextResponse.json({ ok: true })
 }

memento-note/app/api/debug/config/route.ts

@@ -1,41 +0,0 @@
-import { NextResponse } from 'next/server';
-import { getSystemConfig } from '@/lib/config';
-import { auth } from '@/auth';
-
-/**
- * Debug endpoint to check AI configuration
- * This helps verify that OpenAI is properly configured
- */
-export async function GET() {
-  const session = await auth()
-  if (!session?.user?.id) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  }
-  if ((session.user as any).role !== 'ADMIN') {
-    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
-  }
-
-  try {
-    const config = await getSystemConfig();
-
-    // Return only AI-related config for debugging
-    const aiConfig = {
-      AI_PROVIDER_TAGS: config.AI_PROVIDER_TAGS || 'not set',
-      AI_PROVIDER_EMBEDDING: config.AI_PROVIDER_EMBEDDING || 'not set',
-      AI_MODEL_TAGS: config.AI_MODEL_TAGS || 'not set',
-      AI_MODEL_EMBEDDING: config.AI_MODEL_EMBEDDING || 'not set',
-      OPENAI_API_KEY: config.OPENAI_API_KEY ? 'set (hidden)' : 'not set',
-      OLLAMA_BASE_URL: config.OLLAMA_BASE_URL || 'not set',
-      OLLAMA_MODEL: config.OLLAMA_MODEL || 'not set',
-      CUSTOM_OPENAI_BASE_URL: config.CUSTOM_OPENAI_BASE_URL || 'not set',
-      CUSTOM_OPENAI_API_KEY: config.CUSTOM_OPENAI_API_KEY ? 'set (hidden)' : 'not set',
-    };
-
-    return NextResponse.json(aiConfig);
-  } catch (error) {
-    return NextResponse.json(
-      { error: 'Failed to get config', details: error },
-      { status: 500 }
-    );
-  }
-}

memento-note/app/api/debug/test-chat/route.ts

@@ -1,38 +0,0 @@
-import { NextResponse } from 'next/server';
-import { chatService } from '@/lib/ai/services/chat.service';
-import { auth } from '@/auth';
-
-export async function POST(req: Request) {
-  const session = await auth()
-  if (!session?.user?.id) {
-    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  }
-  if ((session.user as any).role !== 'ADMIN') {
-    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
-  }
-
-  try {
-    const body = await req.json();
-    console.log("TEST ROUTE INCOMING BODY:", body);
-    
-    // Simulate what the server action does
-    const result = await chatService.chat(body.message, body.conversationId, body.notebookId);
-    
-    return NextResponse.json({ success: true, result });
-  } catch (err: any) {
-    console.error("====== TEST ROUTE CHAT ERROR ======");
-    console.error("NAME:", err.name);
-    console.error("MSG:", err.message);
-    if (err.cause) console.error("CAUSE:", JSON.stringify(err.cause, null, 2));
-    if (err.data) console.error("DATA:", JSON.stringify(err.data, null, 2));
-    if (err.stack) console.error("STACK:", err.stack);
-    console.error("===================================");
-    return NextResponse.json({ 
-      success: false, 
-      error: err.message,
-      name: err.name,
-      cause: err.cause,
-      data: err.data
-    }, { status: 500 });
-  }
-}