fix: prevent sync timestamp corruption with type-safe UnixSecs wrapper (#157)

[careck]

Summary

Synced notes displayed wildly wrong dates (year 56000+) because the sync replay path stored HLC wall_ms (milliseconds) in columns that expect Unix seconds. This PR fixes the bug and makes it structurally impossible to recur.

• Root cause: apply_incoming_operation in sync.rs wrote ts.wall_ms as i64 (milliseconds) into created_at/modified_at columns, while local creation wrote chrono::Utc::now().timestamp() (seconds). Frontend does new Date(timestamp * 1000).
• Runtime fix: All 6 sync locations now convert to seconds via HlcTimestamp::to_unix_secs()
• Compile-time prevention: New UnixSecs(i64) newtype on Note, UserScript, and AttachmentMeta timestamp fields — assigning raw milliseconds is now a type error
• Regression test: test_apply_incoming_create_note_stores_seconds_timestamp verified red-green

Key design decisions

• No From<i64> — forces UnixSecs::now(), UnixSecs::from_secs(), or ts.to_unix_secs()
• #[serde(transparent)] — JSON unchanged, no frontend impact
• Approach A (seconds-only wrapper) — future Approach B can also wrap milliseconds side (see issue comment)

Files changed (18)

Area	Files	Change
New type	timestamp.rs	UnixSecs + traits
HLC	hlc.rs	to_unix_secs() method
Structs	note.rs, user_script.rs, attachment.rs	i64 → UnixSecs
Sync fix	sync.rs	6× ts.wall_ms → ts.to_unix_secs()
Call sites	notes.rs, scripts.rs, hooks.rs, undo.rs, attachments.rs, export.rs, mod.rs	chrono::Utc::now().timestamp() → UnixSecs::now()
Tests	tests.rs, scripting/tests.rs, display_helpers.rs	Literals → UnixSecs::ZERO/from_secs()

Test plan

• cargo test -p krillnotes-core — 608/608 pass
• cargo check -p krillnotes-desktop — clean
• Regression test red-green verified
• Manual: sync a note between two peers, verify timestamps match

Supersedes #158 and #159. Closes #157.