Harden the server and add a Links page

Security headers, cross-site write refusal, atomic JSON writes, admin backup download, /healthz and Docker health check, OnlyOffice requires a JWT secret, npm test, CI audit, arm64 hub image. New Links tab for personal bookmarks, saved with per-person settings.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

.gitea/workflows/build.yml

@@ -17,6 +17,7 @@ jobs:
         with:
           node-version: 22
       - run: npm ci
+      - run: npm audit --omit=dev --audit-level=high
       - run: node tools/smoke-test.js
       - run: node tools/users-test.js   # accounts: private data, tab limits, invites, migration
       - run: node tools/plex-test.js    # Plex sign-in stays signed in and repairs itself
@@ -25,6 +26,7 @@ jobs:
       - run: node tools/signal-test.js  # Signal: linking, messages, sending, live updates
       - run: node tools/webmail-test.js # the /webmail/ pass-through to the bundled webmail (Cypht)
 
+      - uses: docker/setup-qemu-action@v3
       - uses: docker/setup-buildx-action@v3
 
       # Repo secrets needed (Settings -> Actions -> Secrets):
@@ -48,7 +50,7 @@ jobs:
       - uses: docker/build-push-action@v6
         with:
           context: .
-          platforms: linux/amd64
+          platforms: linux/amd64,linux/arm64
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}