Fix bugs across app + server, optimize UI/UX, add Gitea CI

Bug fixes (Flutter):
- Wrap multi-statement DB writes (insert/update/delete note, deleteDocument,
  deletePageData, OCR FTS merge, migrations) in transactions to prevent data
  loss on interruption and a read-modify-write FTS race.
- Fix PdfDocument leaks on exception (try/finally dispose) and preserve image
  aspect ratio when stamping images onto PDF pages.
- Guard file-picker against empty selection (was .single -> crash).
- Fix eraser ConcurrentModificationError and unmodifiable-list crash on PDF
  pages; capture page synchronously on save to stop wrong-page data loss.
- Fix Riverpod DB-not-ready races, broken pull-to-refresh, settings load race,
  and search N+1; transform stored annotations on PDF page rotation.
- Normalize pen pressure for devices without a pressure range.
- PPT: single source of truth for slide strokes so ink displays and exports.

UI/UX:
- Material 3 typography, theme-aware colors (dark-mode fixes), hover cursors
  and right-click/visible actions on desktop, keyboard shortcuts (undo/redo/
  save/find), toolbar overflow handling, friendlier empty states, semantic OCR
  status badges, relative timestamps, 1-based page indicators, large-deck PPT
  navigation, and a scratchpad-scope label in split view.

Server (optional backend):
- Persist JWT secret (was per-process random), block path traversal in storage,
  fix CORS '*'+credentials, add OCR job ownership checks, last-writer-wins sync
  guard, constant-time login, and split out heavy OCR deps so the API/tests run
  without them.

CI: Gitea workflows for format+analyze+test (Linux, system sqlite) and a
Windows release build; pristine `flutter analyze`, all Flutter and server tests
green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/badnote_server/routers/auth_router.py

@@ -0,0 +1,78 @@
+"""Auth router for BadNote."""
+
+from datetime import datetime, timezone
+from uuid import uuid4
+
+from fastapi import APIRouter, Depends, HTTPException, status
+
+from ..auth import (
+    create_access_token,
+    dummy_verify,
+    get_current_user,
+    hash_password,
+    verify_password,
+)
+from ..database import get_db
+from ..models import TokenResponse, UserCreate, UserLogin
+
+router = APIRouter()
+
+
+@router.post("/register", response_model=TokenResponse, status_code=status.HTTP_201_CREATED)
+async def register(body: UserCreate) -> TokenResponse:
+    """Register a new user."""
+    db = await get_db()
+    existing = await db.execute(
+        "SELECT id FROM users WHERE username = ?", (body.username,)
+    )
+    if await existing.fetchone() is not None:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="Username already taken",
+        )
+
+    user_id = str(uuid4())
+    now = datetime.now(timezone.utc).isoformat()
+    await db.execute(
+        "INSERT INTO users (id, username, password_hash, created_at) VALUES (?, ?, ?, ?)",
+        (user_id, body.username, hash_password(body.password), now),
+    )
+    await db.commit()
+
+    token = create_access_token(user_id)
+    return TokenResponse(token=token, user_id=user_id)
+
+
+@router.post("/login", response_model=TokenResponse)
+async def login(body: UserLogin) -> TokenResponse:
+    """Authenticate and return a token."""
+    db = await get_db()
+    row = await (
+        await db.execute(
+            "SELECT id, password_hash FROM users WHERE username = ?", (body.username,)
+        )
+    ).fetchone()
+
+    if row is None:
+        # Spend comparable time hashing so timing does not reveal whether the
+        # username exists.
+        dummy_verify()
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid username or password",
+        )
+    if not verify_password(body.password, row["password_hash"]):
+        raise HTTPException(
+            status_code=status.HTTP_401_UNAUTHORIZED,
+            detail="Invalid username or password",
+        )
+
+    token = create_access_token(row["id"])
+    return TokenResponse(token=token, user_id=row["id"])
+
+
+@router.post("/refresh", response_model=TokenResponse)
+async def refresh(user_id: str = Depends(get_current_user)) -> TokenResponse:
+    """Refresh an existing valid token."""
+    token = create_access_token(user_id)
+    return TokenResponse(token=token, user_id=user_id)