feat(workspace): link previews above bullets with a web address (M5)

- GET /link-preview?url= fetches the page on the server (https only,
  SSRF-guarded like webhooks), reads Open Graph/Twitter tags, title,
  description and icon from the head, loads picture and icon (no SVG) and
  keeps them in link_previews (migration 6) for 7 days; readers' browsers
  never contact the page. Off in the demo; 300 fetches per address in
  15 minutes.
- Compact card above the bullet (icon, site, title, one line, small
  picture); the duplicate link badge is left out.
- ✕ turns the address into [title](url), so hiding syncs with the note;
  "Link-Vorschauen anzeigen" under appearance switches all off per device.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/lib/__tests__/linkPreview.test.ts

@@ -0,0 +1,21 @@
+import { describe, expect, it } from 'vitest';
+import { firstBareUrl, hidePreviewContent } from '../linkPreview';
+
+describe('link preview helpers', () => {
+  it('finds the first plain https address', () => {
+    expect(firstBareUrl('https://example.com/a?b=1')).toBe('https://example.com/a?b=1');
+    expect(firstBareUrl('Rezept: https://koch.de/spaetzle, lecker!')).toBe('https://koch.de/spaetzle');
+    expect(firstBareUrl('siehe (https://x.de/p).')).toBeNull(); // inside brackets: not a plain address
+    expect(firstBareUrl('[Kochseite](https://koch.de)')).toBeNull();
+    expect(firstBareUrl('http://unsicher.de')).toBeNull();
+    expect(firstBareUrl('nur Text')).toBeNull();
+  });
+
+  it('hides a preview by turning the address into a named link', () => {
+    expect(hidePreviewContent('Lesen: https://koch.de/x', 'https://koch.de/x', 'Käsespätzle [Rezept]')).toBe(
+      'Lesen: [Käsespätzle Rezept](https://koch.de/x)'
+    );
+    expect(hidePreviewContent('https://koch.de/x', 'https://koch.de/x', '')).toBe('[koch.de](https://koch.de/x)');
+    expect(firstBareUrl(hidePreviewContent('https://koch.de/x', 'https://koch.de/x', 'T'))).toBeNull();
+  });
+});