Harden the server and add a Links page

Security headers, cross-site write refusal, atomic JSON writes, admin backup download, /healthz and Docker health check, OnlyOffice requires a JWT secret, npm test, CI audit, arm64 hub image. New Links tab for personal bookmarks, saved with per-person settings.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

package.json

@@ -4,7 +4,9 @@
   "description": "NE Hub: Seafile, OnlyOffice, Plex, mail and audiobooks in one PWA",
   "main": "server.js",
   "scripts": {
-    "start": "node server.js"
+    "start": "node server.js",
+    "test": "for t in smoke users plex player lyrics signal webmail; do node tools/$t-test.js || exit 1; done",
+    "audit": "npm audit --omit=dev --audit-level=high"
   },
   "keywords": [],
   "author": "",
@@ -13,4 +15,4 @@
   "dependencies": {
     "@simplewebauthn/server": "^14.0.3"
   }
-}
+}