Add personal notes, DeepSearch history, backup offload, and gateway auth throttling

Also streamline the top navigation: drop the Tools dropdown, make Quizzes
and Battles icon-only entries, and remove the Workspace, Containers and
Editor entry points from the project detail page.

tests/api/feed.py

@@ -437,6 +437,44 @@ def test_strict_transport_security_header(app_server):
     assert "includeSubDomains" in r.headers.get("Strict-Transport-Security", "")
 
 
+def test_feed_card_truncation_does_not_break_a_straddling_image_url(app_server):
+    s, _ = _session_polls()
+    prefix = "word " * 58
+    url = "https://cdn.example.com/gallery/a-descriptive-name-for-the-photo.jpg"
+    content = prefix + url + " trailing words that must not leak into the truncated preview"
+    r = s.post(
+        f"{BASE_URL}/posts/create",
+        data={
+            "content": content,
+            "title": f"trunc-{int(time.time() * 1000)}",
+            "topic": "devlog",
+        },
+        allow_redirects=False,
+    )
+    assert r.status_code == 302, r.text
+    html = s.get(f"{BASE_URL}/feed").text
+    assert "cdn.example.com" not in html
+    assert "trailing words" not in html
+
+
+def test_feed_card_renders_full_image_embed_when_url_fits_before_truncation(app_server):
+    s, _ = _session_polls()
+    url = "https://cdn.example.com/photo.jpg"
+    content = url + " " + ("caption word " * 5)
+    r = s.post(
+        f"{BASE_URL}/posts/create",
+        data={
+            "content": content,
+            "title": f"embed-{int(time.time() * 1000)}",
+            "topic": "devlog",
+        },
+        allow_redirects=False,
+    )
+    assert r.status_code == 302, r.text
+    html = s.get(f"{BASE_URL}/feed").text
+    assert f'<img src="{url}"' in html
+
+
 def test_referrer_policy_header(app_server):
     r = requests.get(f"{BASE_URL}/feed", allow_redirects=True)
     assert r.headers.get("Referrer-Policy") == "strict-origin-when-cross-origin"