Fix bugs across app + server, optimize UI/UX, add Gitea CI

Bug fixes (Flutter):
- Wrap multi-statement DB writes (insert/update/delete note, deleteDocument,
  deletePageData, OCR FTS merge, migrations) in transactions to prevent data
  loss on interruption and a read-modify-write FTS race.
- Fix PdfDocument leaks on exception (try/finally dispose) and preserve image
  aspect ratio when stamping images onto PDF pages.
- Guard file-picker against empty selection (was .single -> crash).
- Fix eraser ConcurrentModificationError and unmodifiable-list crash on PDF
  pages; capture page synchronously on save to stop wrong-page data loss.
- Fix Riverpod DB-not-ready races, broken pull-to-refresh, settings load race,
  and search N+1; transform stored annotations on PDF page rotation.
- Normalize pen pressure for devices without a pressure range.
- PPT: single source of truth for slide strokes so ink displays and exports.

UI/UX:
- Material 3 typography, theme-aware colors (dark-mode fixes), hover cursors
  and right-click/visible actions on desktop, keyboard shortcuts (undo/redo/
  save/find), toolbar overflow handling, friendlier empty states, semantic OCR
  status badges, relative timestamps, 1-based page indicators, large-deck PPT
  navigation, and a scratchpad-scope label in split view.

Server (optional backend):
- Persist JWT secret (was per-process random), block path traversal in storage,
  fix CORS '*'+credentials, add OCR job ownership checks, last-writer-wins sync
  guard, constant-time login, and split out heavy OCR deps so the API/tests run
  without them.

CI: Gitea workflows for format+analyze+test (Linux, system sqlite) and a
Windows release build; pristine `flutter analyze`, all Flutter and server tests
green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

server/badnote_server/ocr/worker.py

@@ -0,0 +1,69 @@
+"""Background OCR worker for BadNote.
+
+Polls the file-based queue and processes jobs using the OcrEngine.
+"""
+
+import asyncio
+import logging
+import os
+
+from ..config import settings
+from .engine import OcrEngine
+from . import queue as job_queue
+
+logger = logging.getLogger(__name__)
+
+
+async def run_worker(poll_interval: int = 5) -> None:
+    """Poll the queue and process OCR jobs.
+
+    Loads images from the job's image_path and runs them through EasyOCR.
+    """
+    # Ensure queue dirs exist
+    for subdir in ("pending", "processing", "done", "failed"):
+        os.makedirs(os.path.join(settings.queue_path, subdir), exist_ok=True)
+
+    engine = OcrEngine()
+    logger.info("OCR worker started (poll_interval=%ds)", poll_interval)
+
+    while True:
+        job = job_queue.dequeue()
+        if job is not None:
+            job_id = job["id"]
+            logger.info("Processing OCR job %s", job_id)
+            try:
+                # Read image from the path specified in the job
+                image_path = job.get("image_path", "")
+                if image_path and os.path.exists(image_path):
+                    result = await engine.recognize_file(image_path)
+                else:
+                    # Fall back to image_bytes if provided inline
+                    image_bytes = job.get("image_bytes", b"")
+                    if isinstance(image_bytes, str):
+                        import base64
+                        image_bytes = base64.b64decode(image_bytes)
+                    result = await engine.recognize(image_bytes)
+
+                job_queue.complete(job_id, result)
+                logger.info("OCR job %s completed: %d chars", job_id, len(result))
+            except Exception as exc:
+                logger.error("OCR job %s failed: %s", job_id, exc)
+                job_queue.fail(job_id, str(exc))
+        else:
+            await asyncio.sleep(poll_interval)
+
+
+def main() -> None:
+    """Entry point for `python -m badnote_server.ocr.worker`."""
+    logging.basicConfig(
+        level=logging.INFO,
+        format="%(asctime)s [%(levelname)s] %(name)s: %(message)s",
+    )
+    try:
+        asyncio.run(run_worker())
+    except KeyboardInterrupt:
+        logger.info("OCR worker stopped")
+
+
+if __name__ == "__main__":
+    main()