perf: optimize MCP server (O(1) auth, compact JSON, trashedAt fix) + memento-note performance (lazy loading, server-side filtering, XSS fixes, dead code removal, security hardening)

MCP Server:
- Fix validateApiKey: O(1) direct lookup by shortId instead of loading all keys
- Add trashedAt:null filter to ALL note queries (trashed notes leaked in results)
- Compact JSON output (~40% smaller responses)
- Bounded session cache (Map with MAX_SESSIONS=500) to prevent memory leaks
- PostgreSQL connection pooling (connection_limit=10)
- Rewrite all 22 tool descriptions in clear English
- Fix /sse fallback to proper 307 redirect

memento-note Performance:
- loading=lazy on all note images
- Split notebooksRefreshKey from global refreshKey (note CRUD no longer re-fetches notebooks)
- Remove searchKey from trash count deps (no re-fetch on every keystroke)
- Server-side notebookId filter in getAllNotes() (biggest win)
- Skip collaborator fetch for non-shared notes (eliminates N+1 API calls)
- next/dynamic for MarkdownContent + 4 modals (code-split remark/rehype/KaTeX)
- Memoize DOMPurify sanitize with useMemo

Security:
- XSS: DOMPurify sanitize in note-card and note-history-modal
- Auth anti-enumeration: uniform errors in auth.ts
- CRON_SECRET mandatory on cron endpoints
- Rate limiting on login (5 attempts/min per email)
- Centralized API auth helpers (requireAuth/requireAdmin)
- randomize-labels changed GET→POST
- Removed debug endpoints (/api/debug/config, /api/debug/test-chat)

Cleanup:
- Removed dead code: .backup-keep, settings-backup, fix-*.js, debug-theme, fix-labels route
- Removed sensitive console.error in auth.ts
- Ollama fetchWithTimeout (30s/60s AbortController)
- i18n: full Arabic translation, Farsi missing keys
- Masonry drag-and-drop fix (localOrderMap, cross-section block)
- Sidebar notebook tooltip on truncation

memento-note/context/NoteRefreshContext.tsx

@@ -5,18 +5,25 @@ import { createContext, useContext, useState, useCallback, useMemo } from 'react
 interface NoteRefreshContextType {
   refreshKey: number
   triggerRefresh: () => void
+  notebooksRefreshKey: number
+  triggerNotebooksRefresh: () => void
 }
 
 const NoteRefreshContext = createContext<NoteRefreshContextType | undefined>(undefined)
 
 export function NoteRefreshProvider({ children }: { children: React.ReactNode }) {
   const [refreshKey, setRefreshKey] = useState(0)
+  const [notebooksRefreshKey, setNotebooksRefreshKey] = useState(0)
 
   const triggerRefresh = useCallback(() => {
     setRefreshKey(prev => prev + 1)
   }, [])
 
-  const value = useMemo(() => ({ refreshKey, triggerRefresh }), [refreshKey, triggerRefresh])
+  const triggerNotebooksRefresh = useCallback(() => {
+    setNotebooksRefreshKey(prev => prev + 1)
+  }, [])
+
+  const value = useMemo(() => ({ refreshKey, triggerRefresh, notebooksRefreshKey, triggerNotebooksRefresh }), [refreshKey, triggerRefresh, notebooksRefreshKey, triggerNotebooksRefresh])
 
   return (
     <NoteRefreshContext.Provider value={value}>
@@ -33,11 +40,7 @@ export function useNoteRefresh() {
   return context
 }
 
-/**
- * Same as useNoteRefresh but tolerates being called outside the provider
- * (e.g. shared header rendered in admin pages). Returns a no-op when absent.
- */
 export function useNoteRefreshOptional(): NoteRefreshContextType {
   const context = useContext(NoteRefreshContext)
-  return context ?? { refreshKey: 0, triggerRefresh: () => {} }
+  return context ?? { refreshKey: 0, triggerRefresh: () => {}, notebooksRefreshKey: 0, triggerNotebooksRefresh: () => {} }
 }

memento-note/context/notebooks-context.tsx

@@ -84,7 +84,7 @@ export function NotebooksProvider({ children, initialNotebooks = [] }: Notebooks
   const [isLoading, setIsLoading] = useState(true)
   const [isMovingNote, setIsMovingNote] = useState(false)
   const [error, setError] = useState<string | null>(null)
-  const { triggerRefresh, refreshKey } = useNoteRefresh()
+  const { triggerRefresh, triggerNotebooksRefresh, notebooksRefreshKey } = useNoteRefresh()
 
   // ===== DERIVED STATE =====
   const currentLabels = useMemo(() => {
@@ -115,10 +115,9 @@ export function NotebooksProvider({ children, initialNotebooks = [] }: Notebooks
     loadNotebooks()
   }, [loadNotebooks])
 
-  // Recharge les carnets à chaque fois qu'une note est modifiée/supprimée
   useEffect(() => {
-    if (refreshKey > 0) loadNotebooks()
-  }, [refreshKey, loadNotebooks])
+    if (notebooksRefreshKey > 0) loadNotebooks()
+  }, [notebooksRefreshKey, loadNotebooks])
 
   // ===== ACTIONS: NOTEBOOKS =====
   const createNotebookOptimistic = useCallback(async (data: CreateNotebookInput) => {
@@ -134,8 +133,9 @@ export function NotebooksProvider({ children, initialNotebooks = [] }: Notebooks
 
     // Reload notebooks from server to update sidebar state
     await loadNotebooks()
+    triggerNotebooksRefresh()
     triggerRefresh()
-  }, [loadNotebooks, triggerRefresh])
+  }, [loadNotebooks, triggerNotebooksRefresh, triggerRefresh])
 
   const updateNotebook = useCallback(async (notebookId: string, data: UpdateNotebookInput) => {
     const response = await fetch(`/api/notebooks/${notebookId}`, {
@@ -149,8 +149,9 @@ export function NotebooksProvider({ children, initialNotebooks = [] }: Notebooks
     }
 
     await loadNotebooks()
+    triggerNotebooksRefresh()
     triggerRefresh()
-  }, [loadNotebooks, triggerRefresh])
+  }, [loadNotebooks, triggerNotebooksRefresh, triggerRefresh])
 
   const deleteNotebook = useCallback(async (notebookId: string) => {
     const response = await fetch(`/api/notebooks/${notebookId}`, {
@@ -162,8 +163,9 @@ export function NotebooksProvider({ children, initialNotebooks = [] }: Notebooks
     }
 
     await loadNotebooks()
+    triggerNotebooksRefresh()
     triggerRefresh()
-  }, [loadNotebooks, triggerRefresh])
+  }, [loadNotebooks, triggerNotebooksRefresh, triggerRefresh])
 
   const updateNotebookOrderOptimistic = useCallback(async (notebookIds: string[]) => {
     const response = await fetch('/api/notebooks/reorder', {
@@ -177,8 +179,9 @@ export function NotebooksProvider({ children, initialNotebooks = [] }: Notebooks
     }
 
     await loadNotebooks()
+    triggerNotebooksRefresh()
     triggerRefresh()
-  }, [loadNotebooks, triggerRefresh])
+  }, [loadNotebooks, triggerNotebooksRefresh, triggerRefresh])
 
   // ===== ACTIONS: LABELS =====
   const createLabel = useCallback(async (data: CreateLabelInput) => {
@@ -233,6 +236,7 @@ export function NotebooksProvider({ children, initialNotebooks = [] }: Notebooks
       }
 
       await loadNotebooks()
+      triggerNotebooksRefresh()
       triggerRefresh()
     } catch (error) {
       toast.error('Failed to move note. Please try again.')