perf: optimize MCP server (O(1) auth, compact JSON, trashedAt fix) + memento-note performance (lazy loading, server-side filtering, XSS fixes, dead code removal, security hardening)

MCP Server:
- Fix validateApiKey: O(1) direct lookup by shortId instead of loading all keys
- Add trashedAt:null filter to ALL note queries (trashed notes leaked in results)
- Compact JSON output (~40% smaller responses)
- Bounded session cache (Map with MAX_SESSIONS=500) to prevent memory leaks
- PostgreSQL connection pooling (connection_limit=10)
- Rewrite all 22 tool descriptions in clear English
- Fix /sse fallback to proper 307 redirect

memento-note Performance:
- loading=lazy on all note images
- Split notebooksRefreshKey from global refreshKey (note CRUD no longer re-fetches notebooks)
- Remove searchKey from trash count deps (no re-fetch on every keystroke)
- Server-side notebookId filter in getAllNotes() (biggest win)
- Skip collaborator fetch for non-shared notes (eliminates N+1 API calls)
- next/dynamic for MarkdownContent + 4 modals (code-split remark/rehype/KaTeX)
- Memoize DOMPurify sanitize with useMemo

Security:
- XSS: DOMPurify sanitize in note-card and note-history-modal
- Auth anti-enumeration: uniform errors in auth.ts
- CRON_SECRET mandatory on cron endpoints
- Rate limiting on login (5 attempts/min per email)
- Centralized API auth helpers (requireAuth/requireAdmin)
- randomize-labels changed GET→POST
- Removed debug endpoints (/api/debug/config, /api/debug/test-chat)

Cleanup:
- Removed dead code: .backup-keep, settings-backup, fix-*.js, debug-theme, fix-labels route
- Removed sensitive console.error in auth.ts
- Ollama fetchWithTimeout (30s/60s AbortController)
- i18n: full Arabic translation, Farsi missing keys
- Masonry drag-and-drop fix (localOrderMap, cross-section block)
- Sidebar notebook tooltip on truncation

memento-note/components/note-card.tsx

@@ -21,7 +21,8 @@ import {
   AlertDialogTitle,
 } from '@/components/ui/alert-dialog'
 import { Pin, Bell, GripVertical, X, Link2, FolderOpen, StickyNote, LucideIcon, Folder, Briefcase, FileText, Zap, BarChart3, Globe, Sparkles, Book, Heart, Crown, Music, Building2, LogOut, Trash2, AlignLeft, FileCode2, PenLine, ListChecks } from 'lucide-react'
-import { useState, useEffect, useTransition, useOptimistic, memo } from 'react'
+import { useState, useEffect, useTransition, useOptimistic, memo, useMemo } from 'react'
+import dynamic from 'next/dynamic'
 import { useSession } from 'next-auth/react'
 import { useRouter, useSearchParams } from 'next/navigation'
 import { deleteNote, toggleArchive, togglePin, updateColor, updateNote, updateSize, getNoteAllUsers, leaveSharedNote, removeFusedBadge, createNote, restoreNote, permanentDeleteNote } from '@/app/actions/notes'
@@ -42,17 +43,20 @@ import { ar } from 'date-fns/locale/ar'
 import { hi } from 'date-fns/locale/hi'
 import { nl } from 'date-fns/locale/nl'
 import { pl } from 'date-fns/locale/pl'
-import { MarkdownContent } from './markdown-content'
 import { LabelBadge } from './label-badge'
 import { NoteImages } from './note-images'
 import { NoteChecklist } from './note-checklist'
 import { NoteActions } from './note-actions'
-import { CollaboratorDialog } from './collaborator-dialog'
 import { CollaboratorAvatars } from './collaborator-avatars'
 import { ConnectionsBadge } from './connections-badge'
-import { ConnectionsOverlay } from './connections-overlay'
-import { ComparisonModal } from './comparison-modal'
-import { FusionModal } from './fusion-modal'
+
+const MarkdownContent = dynamic(() => import('./markdown-content').then(m => ({ default: m.MarkdownContent })), {
+  loading: () => <div className="text-sm text-muted-foreground animate-pulse">…</div>,
+})
+const CollaboratorDialog = dynamic(() => import('./collaborator-dialog').then(m => ({ default: m.CollaboratorDialog })), { ssr: false })
+const ConnectionsOverlay = dynamic(() => import('./connections-overlay').then(m => ({ default: m.ConnectionsOverlay })), { ssr: false })
+const ComparisonModal = dynamic(() => import('./comparison-modal').then(m => ({ default: m.ComparisonModal })), { ssr: false })
+const FusionModal = dynamic(() => import('./fusion-modal').then(m => ({ default: m.FusionModal })), { ssr: false })
 import { useConnectionsCompare } from '@/hooks/use-connections-compare'
 import { useLabels } from '@/context/LabelContext'
 import { useNoteRefresh } from '@/context/NoteRefreshContext'
@@ -186,6 +190,14 @@ export const NoteCard = memo(function NoteCard({
   const [showNotebookMenu, setShowNotebookMenu] = useState(false)
   const [reminderDate, setReminderDate] = useState<Date | null>(note.reminder ? new Date(note.reminder) : null)
 
+  const sanitizedHtml = useMemo(() => {
+    if (note.type !== 'richtext' || !note.content) return ''
+    if (typeof window !== 'undefined') {
+      return require('isomorphic-dompurify').sanitize(note.content)
+    }
+    return note.content
+  }, [note.type, note.content])
+
   const handleUpdateReminder = async (noteId: string, reminder: Date | null) => {
     startTransition(async () => {
       try {
@@ -257,6 +269,8 @@ export const NoteCard = memo(function NoteCard({
       return
     }
 
+    if (!isSharedNote) return
+
     let isMounted = true
 
     const loadCollaborators = async () => {
@@ -270,7 +284,6 @@ export const NoteCard = memo(function NoteCard({
             }
           }
         } catch (error) {
-          console.error('Failed to load collaborators:', error)
           if (isMounted) {
             setCollaborators([])
           }
@@ -633,7 +646,7 @@ export const NoteCard = memo(function NoteCard({
           onToggleItem={handleCheckItem}
         />
       ) : note.type === 'richtext' ? (
-        <div className="text-sm text-foreground line-clamp-10 rt-preview" dangerouslySetInnerHTML={{ __html: note.content || '' }} />
+        <div className="text-sm text-foreground line-clamp-10 rt-preview" dangerouslySetInnerHTML={{ __html: sanitizedHtml }} />
       ) : (
         <div className="text-sm text-foreground line-clamp-10">
           <MarkdownContent