Architecture review small fixes: migration FK check, web toggles, doc drift #261

Small fixes from the architecture review.

• Migrations with -- foreign_keys: off commit, then run PRAGMA foreign_key_check (internal/store/store.go:237). A violation is reported after the schema and user_version are persisted. Run the check inside the transaction before commit; foreign_key_check works with enforcement off.
• pinToggle (internal/httpd/accounts.go:241), the watch toggle and mark-read (internal/httpd/notifyweb.go) call the store directly and ignore errors, skipping the dispatch write budget and audit. Route them through their commands.
• API.org says tokens are minted on the API (line 16) and that token commands are refused by name (line 55); the code allows them. The 401 in internal/httpd/api.go:131 says "mint one over SSH".
• Parity says batched review is not built; mr comment --pending and publication exist and the web uses them.
• Threat-Model says secrets never appear in URLs; login links carry ?token=. Document the exception, send Cache-Control: no-store on the login flow, and note that proxies must strip the query from logs.