Fix bugs across app + server, optimize UI/UX, add Gitea CI

Bug fixes (Flutter):
- Wrap multi-statement DB writes (insert/update/delete note, deleteDocument,
  deletePageData, OCR FTS merge, migrations) in transactions to prevent data
  loss on interruption and a read-modify-write FTS race.
- Fix PdfDocument leaks on exception (try/finally dispose) and preserve image
  aspect ratio when stamping images onto PDF pages.
- Guard file-picker against empty selection (was .single -> crash).
- Fix eraser ConcurrentModificationError and unmodifiable-list crash on PDF
  pages; capture page synchronously on save to stop wrong-page data loss.
- Fix Riverpod DB-not-ready races, broken pull-to-refresh, settings load race,
  and search N+1; transform stored annotations on PDF page rotation.
- Normalize pen pressure for devices without a pressure range.
- PPT: single source of truth for slide strokes so ink displays and exports.

UI/UX:
- Material 3 typography, theme-aware colors (dark-mode fixes), hover cursors
  and right-click/visible actions on desktop, keyboard shortcuts (undo/redo/
  save/find), toolbar overflow handling, friendlier empty states, semantic OCR
  status badges, relative timestamps, 1-based page indicators, large-deck PPT
  navigation, and a scratchpad-scope label in split view.

Server (optional backend):
- Persist JWT secret (was per-process random), block path traversal in storage,
  fix CORS '*'+credentials, add OCR job ownership checks, last-writer-wins sync
  guard, constant-time login, and split out heavy OCR deps so the API/tests run
  without them.

CI: Gitea workflows for format+analyze+test (Linux, system sqlite) and a
Windows release build; pristine `flutter analyze`, all Flutter and server tests
green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/providers/search_provider.dart

@@ -0,0 +1,93 @@
+import 'package:flutter_riverpod/flutter_riverpod.dart';
+
+import '../models/document.dart';
+import '../models/note.dart';
+import 'note_provider.dart';
+
+final searchQueryProvider = StateProvider<String>((ref) => '');
+
+/// A search result that can be either a note hit or a document hit.
+sealed class SearchResult {
+  const SearchResult();
+}
+
+class NoteSearchHit extends SearchResult {
+  final Note note;
+  final String snippet;
+  const NoteSearchHit({required this.note, this.snippet = ''});
+}
+
+class DocumentSearchHit extends SearchResult {
+  final String documentId;
+  final String filename;
+  final String filePath;
+  final int pageNumber;
+  final String snippet;
+  const DocumentSearchHit({
+    required this.documentId,
+    required this.filename,
+    required this.filePath,
+    required this.pageNumber,
+    this.snippet = '',
+  });
+}
+
+final searchResultsProvider = FutureProvider<List<SearchResult>>((ref) async {
+  final query = ref.watch(searchQueryProvider);
+  if (query.isEmpty) return [];
+
+  // Obtain the DB through the provider graph so this participates in
+  // initialization and disposal like every other consumer.
+  final db = await ref.watch(databaseServiceProvider.future);
+
+  // Run the note and document searches concurrently.
+  final searches = await Future.wait([
+    db.searchNotes(query),
+    db.searchDocuments(query),
+  ]);
+  final noteHits = searches[0] as List<Note>;
+  final docHits = searches[1] as List<Map<String, dynamic>>;
+
+  final results = <SearchResult>[];
+
+  // Add note results.
+  for (final note in noteHits) {
+    results.add(NoteSearchHit(note: note, snippet: note.title));
+  }
+
+  // Resolve document metadata without an N+1 loop: collect the distinct
+  // document ids referenced by the hits, look each up exactly once, then
+  // build the result list from the cached lookups.
+  final docIds = <String>{
+    for (final hit in docHits)
+      if (hit['document_id'] is String) hit['document_id'] as String,
+  };
+  final docEntries = await Future.wait(
+    docIds.map((id) async => MapEntry(id, await db.getDocument(id))),
+  );
+  final docsById = <String, Document>{
+    for (final entry in docEntries)
+      if (entry.value != null) entry.key: entry.value!,
+  };
+
+  for (final hit in docHits) {
+    final documentId = hit['document_id'];
+    if (documentId is! String) continue;
+    final doc = docsById[documentId];
+    if (doc == null) continue;
+
+    final pageNumber = hit['page_number'];
+    final content = hit['content'];
+    results.add(
+      DocumentSearchHit(
+        documentId: documentId,
+        filename: doc.filename,
+        filePath: doc.filePath,
+        pageNumber: pageNumber is int ? pageNumber : 0,
+        snippet: content is String ? content : '',
+      ),
+    );
+  }
+
+  return results;
+});