Fix bugs across app + server, optimize UI/UX, add Gitea CI

Bug fixes (Flutter):
- Wrap multi-statement DB writes (insert/update/delete note, deleteDocument,
  deletePageData, OCR FTS merge, migrations) in transactions to prevent data
  loss on interruption and a read-modify-write FTS race.
- Fix PdfDocument leaks on exception (try/finally dispose) and preserve image
  aspect ratio when stamping images onto PDF pages.
- Guard file-picker against empty selection (was .single -> crash).
- Fix eraser ConcurrentModificationError and unmodifiable-list crash on PDF
  pages; capture page synchronously on save to stop wrong-page data loss.
- Fix Riverpod DB-not-ready races, broken pull-to-refresh, settings load race,
  and search N+1; transform stored annotations on PDF page rotation.
- Normalize pen pressure for devices without a pressure range.
- PPT: single source of truth for slide strokes so ink displays and exports.

UI/UX:
- Material 3 typography, theme-aware colors (dark-mode fixes), hover cursors
  and right-click/visible actions on desktop, keyboard shortcuts (undo/redo/
  save/find), toolbar overflow handling, friendlier empty states, semantic OCR
  status badges, relative timestamps, 1-based page indicators, large-deck PPT
  navigation, and a scratchpad-scope label in split view.

Server (optional backend):
- Persist JWT secret (was per-process random), block path traversal in storage,
  fix CORS '*'+credentials, add OCR job ownership checks, last-writer-wins sync
  guard, constant-time login, and split out heavy OCR deps so the API/tests run
  without them.

CI: Gitea workflows for format+analyze+test (Linux, system sqlite) and a
Windows release build; pristine `flutter analyze`, all Flutter and server tests
green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

lib/services/ocr_service.dart

@@ -0,0 +1,46 @@
+import '../models/note.dart';
+import '../models/pen_tool.dart';
+import 'database_service.dart';
+import 'ocr_engine.dart';
+import 'stroke_rasterizer.dart';
+
+/// Runs OCR locally: typed text from strokes + handwriting via platform OCR.
+class OcrService {
+  /// Extract searchable text from [note] and merge into the local FTS index.
+  Future<void> processNote(Note note) async {
+    final parts = <String>[];
+
+    for (final stroke in note.strokes) {
+      if (stroke.tool == PenTool.text &&
+          stroke.textContent != null &&
+          stroke.textContent!.trim().isNotEmpty) {
+        parts.add(stroke.textContent!.trim());
+      }
+    }
+
+    final handwritingStrokes = note.strokes
+        .where(
+          (s) =>
+              s.tool != PenTool.eraser &&
+              s.tool != PenTool.text &&
+              s.points.isNotEmpty,
+        )
+        .toList();
+
+    if (handwritingStrokes.isNotEmpty) {
+      final png = await StrokeRasterizer.render(handwritingStrokes);
+      if (png != null) {
+        final recognized = await OcrEngine.recognizeImage(png);
+        if (recognized != null && recognized.isNotEmpty) {
+          parts.add(recognized);
+        }
+      }
+    }
+
+    final combined = parts.join(' ').trim();
+    if (combined.isEmpty) return;
+
+    final db = await DatabaseService.getInstance();
+    await db.appendOcrToFts(note.id, combined);
+  }
+}