Harden the server and add a Links page

Security headers, cross-site write refusal, atomic JSON writes, admin backup download, /healthz and Docker health check, OnlyOffice requires a JWT secret, npm test, CI audit, arm64 hub image. New Links tab for personal bookmarks, saved with per-person settings.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

lyrics.js

@@ -2,6 +2,7 @@
 // The hub asks it for synced lyrics only from sources that return real lyrics (not auto-captions), checks that the answer is the same recording,
 // and keeps what it finds on disk so a song is looked up once.
 const fs = require('fs');
+const atomicWrite = require('./atomic');
 const path = require('path');
 const crypto = require('crypto');
 
@@ -76,7 +77,7 @@ async function lookup(artist, title, seconds) {
     const d = await r.json().catch(() => null);
     if (!d) throw Object.assign(new Error('The lyrics service gave an unreadable answer'), { status: 502 });
     const result = shape(d, seconds);
-    try { fs.writeFileSync(f, JSON.stringify({ at: Date.now(), artist, title, result }), { mode: 0o600 }); } catch { /* still answer */ }
+    try { atomicWrite(f, JSON.stringify({ at: Date.now(), artist, title, result }), { mode: 0o600 }); } catch { /* still answer */ }
     return result;
   })().finally(() => inflight.delete(k));
   inflight.set(k, p); return p;