Code-review fixes across both platforms; release 0.13.0

[lukoplt]

Fixes the seven findings from the repo code review, plus one minor issue, and bumps to 0.13.0.

Highest impact

Windows database access was unsynchronized. NotebookStore keeps one SqliteConnection for its lifetime — not thread-safe — but it was used concurrently by EmbeddingWorker's drain, FolderWatchService, Retriever's async continuations, and every Task.Run in the view models. I confirmed the failure mode before fixing: 128 unsynchronized operations produced ArgumentOutOfRangeException from corrupted internal state, then a NullReferenceException on Close() — the connection object itself gets wrecked, not just the query in flight. This is the shape of the intermittent Windows crashes that CI never reproduces. macOS was never affected; GRDB's DatabaseQueue already serializes.

Attachment paths could escape their folder, both platforms. The filename was already reduced to one path component, with a comment naming path traversal as the threat — but the note-folder segment beside it was not, and it arrives as the host of the editor's attachment:// URL. Verified: new Uri("attachment://../db.sqlite").Host == "..", resolving one directory above the attachments root, where the database and settings live. Impact is limited (the editor sets html: false, so I found no exfiltration path) but the containment the code claimed was not enforced.

Also fixed

• Assistant messages were tagged with the engine's construction-time model instead of the per-call override.
• Windows discarded provider-qualified chat models, and the "Regenerate with …" menu did not exist — its localization strings had been sitting unused in both locales. Added; the prefix is validated against the providers table before being treated as composite, since Ollama tags contain colons themselves.
• Retry-After on a 429 was ignored in favor of the app's own much shorter backoff.
• Backups checkpointed a write-ahead log that is never enabled, then copied the live database file. Now uses SQLite's online-backup API — the same mechanism macOS reaches through GRDB.
• A retried answer rendered appended to the failed attempt's partial text.
• PasswordVault.Delete swallowed every exception, making a stuck credential look deleted and then breaking the following Save on the duplicate.

Note on the backup fix

VACUUM INTO was the obvious smaller change and I wrote it first. The tests caught that it silently produces no file at all when the source database is in-memory — no exception, nothing. That would have shipped a backup button that reports success and writes nothing.

Testing

273 C# Core tests (was 256) and 357 Swift tests (was 353) pass. Each new test was verified to fail with its fix reverted — that caught a defect in the tests themselves: the Swift traversal test initially passed with the fix removed, because XCTAssertThrowsError accepted a "file not found" error. Tightened to assert the specific error and plant a real file outside the root; it then reported read ..: did not throw an error, demonstrating the escape concretely.

The App layer is unverified locally — net10.0-windows with a Windows-only XAML compiler, so none of ProviderRouter, ChatViewModel, ChatPage, or WindowsPasswordVaultSecretStore compiles on macOS. Windows CI on this PR is its first real check. Hand-audited instead: all SendAsync callers use named arguments, x:Bind-inside-a-Flyout is already used in the same file, and MenuFlyoutSubItem.Items has no ItemsSource, hence the code-behind population.

Tag v0.13.0 to follow once checks are green.

🤖 Generated with Claude Code