fix: resolve 7 code-scanning alerts

[thetechjon]

Closes all 7 open GitHub code-scanning alerts.

Changes

• ci.yml (Fix notes/folders persistence #1, Update README and clean up Vercel files #2) — added permissions: contents: read least-privilege block.
• subscribe/route.ts (Improve .gitignore #3, ReDoS) — length guard now runs before the email regex.
• embeds.ts (Fix Node requirement docs #5) — escapeMd escapes backslash first.
• propertiesPluginLogic.ts (Add Jest setup and tests for storage hook #6) — escape backslash before pipe.
• public/plugins/noteser-properties/main.js (Fix hooks to persist empty lists #4) — same fix applied manually (no automated build regenerates this file).
• settingsModal.test.tsx (Improve note editor #7, false-positive) — assert exact GitHub href instead of .includes('github.com').

Validation

• lint ✅ · typecheck ✅ · unit tests ✅ (2982 passed, 0 failures)
• Build / Playwright e2e left to CI.

🤖 Generated with Claude Code