Deferred security/correctness items from #46

[LiukScot]

Deferred security/correctness items captured during review of #46. Each is documented with file:line, severity, patch sketch, and required test in the PR body.

• HIGH — Authorization bypass via ancestor-cycle in PATCH /pages/:id parentPageId — apps/server/src/routes/pages.ts:199-201. Walk ancestor chain before accepting reparent.
• HIGH — sortOrder race condition — apps/server/src/routes/pages.ts:113, apps/server/src/routes/databases.ts:104-135. Move getNextSortOrder() inside the tx.
• MEDIUM — File upload magic-byte validation — apps/server/src/routes/pages.ts:220-278. Validate uploaded image bytes with file-type.
• MEDIUM — Cell upsert lacks composite primary key — apps/server/src/routes/databases.ts:503-525, apps/server/src/db/schema.ts:79-87. Add composite PK (row_id, property_id) + onConflictDoUpdate.
• MEDIUM — CORS allows non-browser origins unconditionally — apps/server/src/index.ts:27-28. Return null to deny instead of falsy.

Full patches + decision notes in PR body of #46.