Address Gadfly review findings on Phase 0

Applied the fixes warranted by the adversarial review of PR #21 (all
findings graded in the gadfly store):

Store (highest impact):
- buildDSN always merges busy_timeout/journal_mode/foreign_keys pragmas
  into the DSN, even for file: URIs or paths with a query string — the
  prior passthrough silently disabled FK enforcement for those PANSY_DB
  values. Also escape '#' in the path and tighten in-memory detection to
  an exact ':memory:' token or mode=memory param (no substring misfire).
- migrate.go: detect duplicate migration versions with a clear error;
  wrap appliedVersions' rows.Err() with the store: prefix.

API:
- SetTrustedProxies failure now falls back to trust-none instead of
  leaving gin's trust-everyone default (X-Forwarded-For spoofing).
- SPA: 404 embedded directories (was a directory listing), 404 bare /api,
  add X-Content-Type-Options: nosniff, cache index.html bytes once at
  startup, single fs.Stat existence check, shared writeAPIError helper.
- Move gin.SetMode out of package init() into New().

Config: validate PANSY_PORT range (fall back to 8080 with a warning).

Web:
- api.ts: serialize the request body before the fetch try so a
  JSON.stringify failure isn't misreported as a network error.
- AppShell: move state-specific/conflicting utilities into
  active/inactiveProps so concatenated Tailwind classes don't collide.

Tests: added store DSN-pragma/memory-detection cases and SPA
directory-404 case. go build/vet/test clean (CGO off); web tsc + build
clean; re-verified in a browser (SPA, deep links, /assets 404, nav).

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

web/src/components/layout/AppShell.tsx

@@ -1,11 +1,17 @@
 import { Link, Outlet } from '@tanstack/react-router'
-import { cn } from '@/lib/cn'
 
 const navLinks = [
   { to: '/gardens', label: 'Gardens' },
   { to: '/plants', label: 'Plants' },
 ] as const
 
+// TanStack Router concatenates the base className with activeProps/inactiveProps,
+// so state-specific and conflicting utilities (text-muted vs text-fg) live in the
+// state props — never in the base — to avoid ambiguous overrides.
+const navLinkBase = 'rounded-md px-3 py-1.5 text-sm font-medium transition-colors'
+const navLinkActive = 'bg-border/60 text-fg'
+const navLinkInactive = 'text-muted hover:bg-border/60 hover:text-fg'
+
 /** Top-level chrome: a sticky nav bar plus the routed page in an <Outlet>. */
 export function AppShell() {
   return (
@@ -20,10 +26,9 @@ export function AppShell() {
               <Link
                 key={l.to}
                 to={l.to}
-                className={cn(
-                  'rounded-md px-3 py-1.5 text-sm font-medium text-muted transition-colors hover:bg-border/60 hover:text-fg',
-                )}
-                activeProps={{ className: 'bg-border/60 text-fg' }}
+                className={navLinkBase}
+                activeProps={{ className: navLinkActive }}
+                inactiveProps={{ className: navLinkInactive }}
               >
                 {l.label}
               </Link>