Harden the server and add a Links page

Security headers, cross-site write refusal, atomic JSON writes, admin backup download, /healthz and Docker health check, OnlyOffice requires a JWT secret, npm test, CI audit, arm64 hub image. New Links tab for personal bookmarks, saved with per-person settings.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

caldav.js

@@ -2,6 +2,7 @@
 // Create the password at appleid.apple.com -> Sign-In and Security -> App-Specific Passwords.
 // Credentials are encrypted at rest with a key derived from the server's secret. Only *.icloud.com is ever contacted.
 const fs = require('fs');
+const atomicWrite = require('./atomic');
 const path = require('path');
 const crypto = require('crypto');
 const auth = require('./auth');
@@ -18,7 +19,7 @@ const seal = obj => { const iv = crypto.randomBytes(12), c = crypto.createCipher
 const unseal = b64 => { const b = Buffer.from(b64, 'base64'), d = crypto.createDecipheriv('aes-256-gcm', key(), b.subarray(0, 12));
   d.setAuthTag(b.subarray(12, 28)); return JSON.parse(Buffer.concat([d.update(b.subarray(28)), d.final()]).toString('utf8')); };
 function load() { try { return unseal(JSON.parse(fs.readFileSync(file(), 'utf8')).data); } catch { return null; } }
-function save(o) { fs.writeFileSync(file(), JSON.stringify({ data: seal(o) }), { mode: 0o600 }); }
+function save(o) { atomicWrite(file(), JSON.stringify({ data: seal(o) }), { mode: 0o600 }); }
 function wipe() { try { fs.unlinkSync(file()); } catch {} }
 
 // ---- HTTP + XML