perf: optimize MCP server (O(1) auth, compact JSON, trashedAt fix) + memento-note performance (lazy loading, server-side filtering, XSS fixes, dead code removal, security hardening)

MCP Server:
- Fix validateApiKey: O(1) direct lookup by shortId instead of loading all keys
- Add trashedAt:null filter to ALL note queries (trashed notes leaked in results)
- Compact JSON output (~40% smaller responses)
- Bounded session cache (Map with MAX_SESSIONS=500) to prevent memory leaks
- PostgreSQL connection pooling (connection_limit=10)
- Rewrite all 22 tool descriptions in clear English
- Fix /sse fallback to proper 307 redirect

memento-note Performance:
- loading=lazy on all note images
- Split notebooksRefreshKey from global refreshKey (note CRUD no longer re-fetches notebooks)
- Remove searchKey from trash count deps (no re-fetch on every keystroke)
- Server-side notebookId filter in getAllNotes() (biggest win)
- Skip collaborator fetch for non-shared notes (eliminates N+1 API calls)
- next/dynamic for MarkdownContent + 4 modals (code-split remark/rehype/KaTeX)
- Memoize DOMPurify sanitize with useMemo

Security:
- XSS: DOMPurify sanitize in note-card and note-history-modal
- Auth anti-enumeration: uniform errors in auth.ts
- CRON_SECRET mandatory on cron endpoints
- Rate limiting on login (5 attempts/min per email)
- Centralized API auth helpers (requireAuth/requireAdmin)
- randomize-labels changed GET→POST
- Removed debug endpoints (/api/debug/config, /api/debug/test-chat)

Cleanup:
- Removed dead code: .backup-keep, settings-backup, fix-*.js, debug-theme, fix-labels route
- Removed sensitive console.error in auth.ts
- Ollama fetchWithTimeout (30s/60s AbortController)
- i18n: full Arabic translation, Farsi missing keys
- Masonry drag-and-drop fix (localOrderMap, cross-section block)
- Sidebar notebook tooltip on truncation

memento-note/components/masonry-grid.tsx

@@ -185,7 +185,16 @@ export function MasonryGrid({
 
   if (notes !== prevNotesRef.current) {
     const localSizeMap = new Map(localNotes.map(n => [n.id, n.size]));
+    const localOrderMap = new Map(localNotes.map((n, i) => [n.id, i]));
     const newLocalNotes = notes.map(n => ({ ...n, size: localSizeMap.get(n.id) ?? n.size }));
+    newLocalNotes.sort((a, b) => {
+      const oA = localOrderMap.get(a.id)
+      const oB = localOrderMap.get(b.id)
+      if (oA !== undefined && oB !== undefined) return oA - oB
+      if (oA !== undefined) return -1
+      if (oB !== undefined) return 1
+      return 0
+    })
     setLocalNotes(newLocalNotes);
     prevNotesRef.current = notes;
   }
@@ -239,16 +248,20 @@ export function MasonryGrid({
 
     if (!over || active.id === over.id) return;
 
-    const reordered = arrayMove(
-      localNotesRef.current,
-      localNotesRef.current.findIndex(n => n.id === active.id),
-      localNotesRef.current.findIndex(n => n.id === over.id),
-    );
+    const current = localNotesRef.current
+    const activeIdx = current.findIndex(n => n.id === active.id)
+    const overIdx = current.findIndex(n => n.id === over.id)
+    if (activeIdx === -1 || overIdx === -1) return
 
+    const activeNote = current[activeIdx]
+    const overNote = current[overIdx]
+
+    if (activeNote.isPinned !== overNote.isPinned) return
+
+    const reordered = arrayMove(current, activeIdx, overIdx);
     if (reordered.length === 0) return;
 
     setLocalNotes(reordered);
-    // Persist order outside of setState to avoid "setState in render" warning
     const ids = reordered.map(n => n.id);
     updateFullOrderWithoutRevalidation(ids).catch(err => {
       console.error('Failed to persist order:', err);