Support clickable links and permalinks for annotations

[kaito-harry]

Problem

Annotation notes are currently rendered as escaped plain text. A URL entered in a note is visible, but it is not styled or clickable, so reviewers must copy and paste it manually.

Annotations also do not expose a stable Copy comment link action. This makes it difficult to reference a specific review comment from another document, issue, or chat.

This is especially useful for cross-document reviews, where one annotation needs to point to the relevant section in another Markdown file.

Proposed behavior

1. Make URLs in annotation notes clickable. Either auto-link plain http:// / https:// strings or support a safe subset of Markdown links.
2. Add a Copy comment link action to each annotation.
3. Opening a copied link should load the document, scroll to the annotation, highlight it, and open/focus its note.
4. The permalink should contain the document URL and a stable annotation identifier, at least for shared annotations.

Security requirements

• Keep the current XSS protection.
• Allow only safe URL schemes such as http: and https: (and optionally relative links).
• Escape link text and sanitize destinations.
• Use appropriate rel="noopener noreferrer" behavior for links opened in a new tab.

UX reference

Feishu comments provide both behaviors:

• A URL entered as a plain string is displayed as an underlined, clickable link.
• The comment toolbar provides a button to copy a direct link to that comment.

Acceptance criteria

• URLs in annotation notes are visibly styled and clickable.
• Unsafe URL schemes and HTML injection remain blocked.
• Each shared annotation has a Copy comment link action.
• Visiting the copied link opens the correct document and focuses the target annotation.
• The behavior works after page reload and when the link is opened in a new browser tab.
• Tests cover URL rendering, sanitization, permalink generation, and annotation restoration.

Environment

• Markon v0.14.4

[kookyleo]

Implemented as Note links rather than "permalinks".

Rationale:

• A note link is useful for sharing and returning to a specific note, but it should not promise permanence: the note can be deleted, the underlying text can drift, or the file can change enough that the anchor no longer resolves.
• The user-facing wording is therefore "Copy note link" / "Note link", not "permalink".

Implementation shape:

• Note text remains stored as plain text. Rendering now safely auto-links only http:// and https:// URLs. Unsafe schemes such as javascript: stay plain text. Generated anchors use target="_blank" and rel="noopener noreferrer".
• Each note card / popup gets a Copy note link action. Links use the existing stable annotation id as a best-effort target: /{workspace_id}/{file_path}#note-{annotation_id}.
• Opening a note link waits for annotations to load, scrolls to the matching note highlight, activates the note, and briefly outlines the target. If the note or anchor no longer exists, the page shows a lightweight "Note link is no longer valid" message.
• Rendered diff note links point back to the normal Markdown document page, not the compare page, so the shared link lands in the canonical reading surface.

This avoids DB/schema changes and reuses the existing annotation id + text-anchor model.