p2: fence document tags, atomic fleetctx, harden workspace

Neutralise </document and <document in page text. Counters are
atomic.Uint64. Workspace names are [A-Za-z0-9_-] and PathEscaped;
foreign workspace_id rows are dropped. Wayback closest.url must be
https://web.archive.org. archive.today snapshot_at is Memento-Datetime
or null.

internal/api/api.go

@@ -353,9 +353,14 @@ func (s *Server) v1fetch(w http.ResponseWriter, r *http.Request) {
 	}
 	if snap != nil {
 		src["kind"] = "snapshot"
-		src["snapshot_at"] = snap.SnapshotAt
 		src["via"] = string(snap.Via)
 		src["original_url"] = snap.OriginalURL
+		if snap.SnapshotAt != "" {
+			src["snapshot_at"] = snap.SnapshotAt
+		} else {
+			src["snapshot_at"] = nil
+			warn = append(warn, "snapshot date unknown")
+		}
 	}
 	out := map[string]any{
 		"content":   content,