p2: fence document tags, atomic fleetctx, harden workspace

Neutralise </document and <document in page text. Counters are
atomic.Uint64. Workspace names are [A-Za-z0-9_-] and PathEscaped;
foreign workspace_id rows are dropped. Wayback closest.url must be
https://web.archive.org. archive.today snapshot_at is Memento-Datetime
or null.

internal/fleetctx/fleetctx_test.go

@@ -6,6 +6,7 @@ import (
 	"io"
 	"net/http"
 	"net/http/httptest"
+	"sync"
 	"testing"
 	"time"
 )
@@ -71,3 +72,48 @@ func TestHappyPath(t *testing.T) {
 		t.Fatalf("%v %q", items, warn)
 	}
 }
+
+func TestTraversalRejected(t *testing.T) {
+	c := &Client{Base: "http://127.0.0.1:1", Allow: []string{"hermes-fleet"}}
+	_, warn := c.Search(context.Background(), "hermes-fleet/../guardian-star", "q")
+	if warn == "" {
+		t.Fatal("want skip")
+	}
+}
+
+func TestDropsForeignWorkspace(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_ = json.NewEncoder(w).Encode([]map[string]any{
+			{"content": "secret", "peer_id": "x", "workspace_id": "guardian-star", "session_id": "s", "created_at": "t"},
+			{"content": "ok", "peer_id": "y", "workspace_id": "hermes-fleet", "session_id": "s", "created_at": "t"},
+		})
+	}))
+	defer ts.Close()
+	c := &Client{Base: ts.URL, Allow: []string{"hermes-fleet"}, HTTP: ts.Client()}
+	items, warn := c.Search(context.Background(), "hermes-fleet", "q")
+	if warn != "" || len(items) != 1 || items[0].Content != "ok" {
+		t.Fatalf("%v %q", items, warn)
+	}
+}
+
+func TestConcurrentSearch(t *testing.T) {
+	ts := httptest.NewServer(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		_ = json.NewEncoder(w).Encode([]map[string]any{{
+			"content": "ok", "peer_id": "y", "workspace_id": "hermes-fleet", "session_id": "s", "created_at": "t",
+		}})
+	}))
+	defer ts.Close()
+	c := &Client{Base: ts.URL, Allow: []string{"hermes-fleet"}, HTTP: ts.Client()}
+	var wg sync.WaitGroup
+	for i := 0; i < 32; i++ {
+		wg.Add(1)
+		go func() {
+			defer wg.Done()
+			_, _ = c.Search(context.Background(), "hermes-fleet", "q")
+		}()
+	}
+	wg.Wait()
+	if c.Calls.Load() != 32 {
+		t.Fatalf("calls %d", c.Calls.Load())
+	}
+}