Security hardening: fix critical, high, and medium issues from audit

CRITICAL:
- A-001: SQL injection in snapshot — escape single quotes in backup path
- A-002: Timing attack — always verify against dummy hash when user not
  found, preventing username enumeration
- A-003: Notebook ownership — all authenticated endpoints now verify
  user_id before loading notebook data
- A-004: Point data bounds — decodePoints returns error on misaligned
  data, >4MB payloads, and NaN/Inf values

HIGH:
- A-005: Error messages — generic errors in HTTP responses, no err.Error()
- A-006: Share link authz — RevokeShareLink verifies notebook ownership
- A-007: Scan errors — return 500 instead of silently continuing

MEDIUM:
- A-008: Web server TLS — optional TLS support (HTTPS when configured)
- A-009: Input validation — page_size, stroke count, point_data alignment
  checked in SyncNotebook RPC
- A-010: Graceful shutdown — 30s drain on SIGINT/SIGTERM, all servers
  shut down properly

Added AUDIT.md with all 17 findings, status, and rationale for
accepted risks.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/webserver/handlers.go

@@ -83,7 +83,8 @@ func (ws *WebServer) handleNotebooks(w http.ResponseWriter, r *http.Request) {
 		var nb notebook
 		var syncedAt int64
 		if err := rows.Scan(&nb.ID, &nb.Title, &nb.PageSize, &syncedAt, &nb.PageCount); err != nil {
-			continue
+			http.Error(w, "Internal error", http.StatusInternalServerError)
+			return
 		}
 		nb.SyncedAt = time.UnixMilli(syncedAt).Format("2006-01-02 15:04")
 		notebooks = append(notebooks, nb)
@@ -118,7 +119,8 @@ func (ws *WebServer) handleNotebook(w http.ResponseWriter, r *http.Request) {
 	for rows.Next() {
 		var num int
 		if err := rows.Scan(&num); err != nil {
-			continue
+			http.Error(w, "Internal error", http.StatusInternalServerError)
+			return
 		}
 		pages = append(pages, pageInfo{
 			Number:   num,
@@ -182,7 +184,8 @@ func (ws *WebServer) handleShareNotebook(w http.ResponseWriter, r *http.Request)
 	for rows.Next() {
 		var num int
 		if err := rows.Scan(&num); err != nil {
-			continue
+			http.Error(w, "Internal error", http.StatusInternalServerError)
+			return
 		}
 		pages = append(pages, pageInfo{
 			Number:   num,