Link safety, message accuracy, and honest AI promises

A round focused on link safety and honest messaging.

• Links in notes and AI responses now pass a stricter safety check at the source, so only safe address formats open
• Fixed a message that could read like a partial success when every file in an upload had failed
• Corrected the device-release guide to match the actual flow (one step per device)
• Tuned the AI assistant so it no longer promises actions it doesn't actually support
• Plus broader server- and client-side validation hardening