Quote refs: >>note: ids hydrate as inline quote cards on VS Code and CLI

[RemilioNubilio]

Implements the quote ref convention from #212: >>note:<wallet>:<ms>:<nonce> in a post or comment hydrates as an inline quote card on VS Code and the CLI. The feed's hyperlink, finishing what blockchan's >>txSignature quotelinks start: those resolve only inside one loaded page, a note id makes the quote portable across threads, surfaces, and databases.

Shape

• Pure text convention. No contract, seed, message type, or on-chain change. A ref costs only its bytes; the write path does not know quotes exist.
• Resolution reuses getBlogPost verbatim on every surface, through the same spoof-proof read an open uses (the author's own table is the truth, the anchor is permissionless). A miss renders as a deadlink, not an error.
• Lazy and capped at 4 refs per note, so a pathological note cannot fan out unbounded reads.

What each layer gets

• Core: extractQuoteRefs / parseNoteRef (the ref grammar, deduped, capped) plus specs. That is all core gets.
• VS Code panel: refs in the post body and comments become compact markers with a hydrated card under the paragraph; click opens the quoted post in the reader. Resolution rides the existing getBlogPost message, disambiguated from reader opens by an inflight map; quote resolutions pre-seed the reader cache so the click-through is instant.
• CLI: cards under the post body, [1-4] opens the matching quote in the reader (quote-hop). The footer hints the keys only when refs exist.

Verified

• Core specs green; full suite 353/353; tsc clean on core, cli, vscode; builds green.
• Devnet end to end, real writes: posted a fixture, posted a second post quoting it, watched the real CLI hydrate the card from chain and [1]-hop into the quoted post; the deadlink path resolves null and renders dead.

• Multi-agent adversarial review over the diff (six lenses: both surfaces' correctness, XSS, template escaping, spec quality, and the five rules) with two refuters per finding; everything that survived was fixed before this PR.

The review confirmed six findings and all six are fixed in this diff: a cross-open hydration race (late settles from a previous post could stamp a stale null over a fresh card; fixed with an open epoch fence), a permanent negative cache in the panel (a transient null read pinned a deadlink for the panel lifetime; nulls are no longer cached so the next render retries), an untitled quote printing its first line twice on the CLI (the snippet now starts at line 2, matching the panel), and a ref grammar divergence between the surfaces plus a greedy nonce with no trailing boundary (both regexes are now byte-identical, pinned to each other by comments on both sides, and a ref glued to alphanumeric text is no match rather than a corrupted id; the grammar matches what buildNote actually mints).

The five rules, against this diff

1. No meaningless wrappers. None added; the only new function-shaped things parse or render.
2. Reuse first. Resolution is the existing getBlogPost on both surfaces; the CLI imports the core parser. The panel template cannot import core, so it carries its own regex; the two grammars are pinned to each other (see the review note above).
3. No single-use type variables. QuoteRef is used across core, spec, and the CLI.
4. No non-essential parameters. The renderer's quotes param is the hydration state the view owns; nothing else changed shape.
5. Responsibilities stay separated. Core parses, surfaces render, the read path resolves. Nothing on the write path changed.

Deadlinks stay dead links, quotes stay portable. The feed becomes a web.