Harden the server and add a Links page

Security headers, cross-site write refusal, atomic JSON writes, admin backup download, /healthz and Docker health check, OnlyOffice requires a JWT secret, npm test, CI audit, arm64 hub image. New Links tab for personal bookmarks, saved with per-person settings.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

atomic.js

@@ -0,0 +1,8 @@
+// Write a file so a crash or power cut never leaves half of it: write to a temp file, then rename over the original.
+const fs = require('fs');
+const crypto = require('crypto');
+module.exports = function writeFileAtomic(file, data, opts = { mode: 0o600 }) {
+  const tmp = file + '.' + crypto.randomBytes(4).toString('hex') + '.tmp';
+  try { fs.writeFileSync(tmp, data, opts); fs.renameSync(tmp, file); }
+  catch (e) { try { fs.unlinkSync(tmp); } catch {} throw e; }
+};