fix(workspace): hidden bullet actions on phones, no second extract, notice layout

- The floating bullet actions only react to hover on devices with a real
  pointer; a tap on a phone made the invisible buttons clickable.
- A bullet that is only a note link (plus hashtags) can no longer be
  extracted: button and /extract are hidden, the server answers 400.
- Extract notice on phones sits above the bottom navigation, text on
  top (two lines max) with the actions below.
- Release v0.26.1.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/restructure_test.go

@@ -84,6 +84,23 @@ func TestExtractBranchIntoOwnNote(t *testing.T) {
 	}
 }
 
+func TestExtractRejectsBulletThatIsOnlyANoteLink(t *testing.T) {
+	srv, store, token := setupTestServer(t)
+	router := srv.Router()
+	claims, _ := auth.ValidateToken(testJWTSecret, token)
+	src, _ := store.CreateDocument(claims.UserID, "", "Projekt", "", "", []domain.DocumentBlock{
+		{ID: "blk_l", Type: "bullet", Content: "[[Konzept: Garten]] #draußen", Level: 0, Position: 1},
+		{ID: "blk_m", Type: "bullet", Content: "Siehe [[Konzept: Garten]] für Details", Level: 0, Position: 2},
+	}, nil, false)
+	if rec := sessionCall(router, "POST", "/api/v1/documents/"+src.ID+"/extract", token, `{"blockId":"blk_l"}`, ""); rec.Code != http.StatusBadRequest {
+		t.Fatalf("link-only bullet: want 400, got %d %s", rec.Code, rec.Body.String())
+	}
+	// A link inside other text is ordinary content
+	if rec := sessionCall(router, "POST", "/api/v1/documents/"+src.ID+"/extract", token, `{"blockId":"blk_m"}`, ""); rec.Code != http.StatusCreated {
+		t.Fatalf("bullet with text and link: want 201, got %d %s", rec.Code, rec.Body.String())
+	}
+}
+
 func TestExtractInSharedNoteKeepsAccess(t *testing.T) {
 	srv, store, _ := setupTestServer(t)
 	router := srv.Router()