feat: spaces, folder import, boards and mail; rename to narl-workspace

The diary grows into a workspace: a flat list of dated entries becomes a
tree of spaces, and the app is renamed to match what it now is.

Spaces and nodes
  One recursive `nodes` table replaces `entries`: a space is a root node,
  and folders and documents nest under it without limit. Entries keep
  their ids through the migration, so share tokens, media links and the
  drafts in localStorage all still resolve.

Folder import
  A folder or a zip is uploaded as a document tree. Markdown becomes
  documents titled from their first heading, everything else becomes
  media, and relative links between the imported files are rewritten to
  the paths they landed at, so a set of cross-linked notes stays
  navigable after the upload.

Boards
  A kanban board per space, with the space as the board: lists, cards,
  due dates and an optional link to a document. `diary` has none.

Mail
  SMTP notifications through an outbox. A mail is enqueued under a key
  naming the occurrence it belongs to, so a restart cannot resend and a
  relay that refuses is retried with a widening backoff. Four kinds: the
  diary reminder, cards due and overdue, a weekly digest, and logins
  from a browser that has not been seen before or a burst of failures.
  All of it is dormant until WORKSPACE_SMTP_URL is set.

Rename
  Everything user-visible says workspace; everything that already exists
  outside this repo keeps its name, because renaming it would break a
  running deployment for tidiness alone: the database file, the docker
  volume, the session cookie, the Proton device, the keyring entry and
  the localStorage keys. Configuration reads WORKSPACE_* first and falls
  back to DIARY_*, so the deployed .env keeps working untouched.

migrations/0008_notifications.sql

@@ -0,0 +1,37 @@
+-- Mail is sent through an outbox rather than straight from the code that
+-- decides a mail is due. Two reasons, both of which have bitten every reminder
+-- that skips this step: a restart must not send yesterday's reminder again, and
+-- a relay that is down for an hour must not lose the mail it refused.
+--
+-- `dedupe_key` carries the whole idea. It spells out *which* occurrence this is
+-- ("reminder:2026-09-18", "card_due:41:2026-09-20:overdue"), so deciding
+-- whether a mail was already sent is an insert that either takes or does not.
+
+CREATE TABLE notifications (
+    id              INTEGER PRIMARY KEY AUTOINCREMENT,
+    kind            TEXT    NOT NULL,
+    dedupe_key      TEXT    NOT NULL UNIQUE,
+    subject         TEXT    NOT NULL,
+    body            TEXT    NOT NULL,
+    created_at      INTEGER NOT NULL,
+    sent_at         INTEGER,
+    attempts        INTEGER NOT NULL DEFAULT 0,
+    -- When the last attempt was made, which is what the backoff is measured
+    -- from; a count alone cannot say whether it is time to try again.
+    last_attempt_at INTEGER,
+    last_error      TEXT
+);
+
+-- The sweep asks one question every minute: what is still unsent?
+CREATE INDEX idx_notifications_pending ON notifications (created_at) WHERE sent_at IS NULL;
+
+-- Which browsers have logged in. The hash is over the User-Agent, so this can
+-- honestly say "a browser you have not used before", not "someone else" — and
+-- it needs no proxy header to be trusted for it.
+CREATE TABLE login_events (
+    id            INTEGER PRIMARY KEY AUTOINCREMENT,
+    device_hash   TEXT    NOT NULL UNIQUE,
+    user_agent    TEXT    NOT NULL,
+    first_seen_at INTEGER NOT NULL,
+    last_seen_at  INTEGER NOT NULL
+);