Store bodies as HackMD does and flag title drift

[jserv]

Bodies and titles now follow how HackMD actually stores them. HackMD reads \r\n and a lone \r back as \n (measured 2026-10-08), so a body sent with CRLF could never be confirmed by its read-back, and a working file saved with CRLF looked changed on every sync check. Bodies a caller supplies and every local file read for sync are now converted first; a body read from HackMD and resent goes back exactly as read. An explicit title always wins and later body edits never rename a note, so pull and push now report title_drift when the body's own title (plain front matter, or an H1 that is its first line of text) differs from the listed one. Anything the parser cannot read for certain gives none, since a wrong suggestion would rename a note. Read-back now checks an explicit title too.

Pull also reports changes, a bounded diff of what it replaced in the local file. LocalFiles::write_atomic takes an Expect (the size and modification time of the file the caller read, or absent), checked just before the rename, so an editor's save during a pull, or into a conflict's *.remote.md, is refused as a conflict instead of lost. Three smaller commits keep upstream error details intact when no token is set, skip sizing a note list the cache will not keep, and fold RemoteSource into list_notes.

Verified with cargo fmt --check, cargo clippy --all-targets --all-features -- -D warnings, and make check (344 lib tests, 11 stdio tests); the third commit also passes clippy and its 325 lib tests on its own. A probe ran 2.56 million generated four-line bodies through the title parser: no panic, and no title carrying markup. The live suites were not run.

Left out: how HackMD derives a title beyond the measured precedence (inline markup, repeated spaces) is unmeasured, so the parser stays narrow until it is. A conflict snapshot is still removed if its sidecar write fails right after an editor saved into it; that predates this change.

---

Summary by cubic

Stores note bodies in the form HackMD actually keeps and reports title drift, so a CRLF file no longer looks changed on every sync check and a renamed H1 no longer diverges from the listing silently.

Bodies and titles

• Converts \r\n and lone \r to \n in every caller-supplied body and every local file read for sync; HackMD reads those back as \n, so a resent body goes back exactly as read.
• An explicit title always wins and later body edits never rename a note; hackmd_pull_note and hackmd_push_note report title_drift when the body's own title differs from the listed one, only when the parser can read that title for certain (plain front matter, or an H1 that is the body's first line of text). Push reports it only on a push or a no-op, so a missing title_drift does not mean the titles match.

Conflict safety

• Pull reports changes, a bounded diff of what it replaced locally, and none when the old file was unreadable, oversized, not UTF-8, missing, or already matched.
• LocalFiles::write_atomic takes an Expect — the size and modification time of the file the caller read — checked just before the rename, so an editor's save during a pull or into a conflict's *.remote.md is refused as a conflict instead of lost; a dangling symlink standing where nothing was expected is refused for the same reason.
• The front-matter parser trusts only the indented lines a value can actually take, so stray YAML can never hide or fake a title:.
• Preserves upstream error details when no token is set, skips sizing a note list the cache will not keep, and folds RemoteSource into list_notes.

^{Written for commit 1312293. Summary will update on new commits.}