feat: complete favorites system — sidebar, library, context menu, API

6 files changed:
- db.py: migrate favorites table FK from collection_pages(id) to pages(id)
- board.py: add favorites API (POST/DELETE /board/api/favorites/{id}, GET list)
- board.py: _sidebar_data() now loads favorite_pages from DB via JOIN
- dashboard.py: library_page loads lib_favorites from DB (not parent_section)
- csrf.py: exclude /board/api/favorites from CSRF checks
- base.html: context menu toggles Add/Remove Favorites based on state
- base.html: favoriteIds Alpine set initialized from server-rendered favorites
- test_app.py: test_favorites_crud rewritten for new page-based favorites API

Favorites now work end-to-end:
- Right-click → Add to Favorites (or Remove if already favorited)
- Sidebar Favorites section shows favorited pages
- Library Favorites tab shows the same pages
- API: POST/DELETE /board/api/favorites/{page_id}, GET /board/api/favorites

tests/test_app.py

@@ -868,19 +868,29 @@ def test_comments_crud(client):
 
 
 def test_favorites_crud(client):
-    r = client.post("/db/api", json={"name": "Fav DB"})
-    cid = r.json()["id"]
+    """Test favorites CRUD for sidebar pages — POST/DELETE /board/api/favorites/{page_id}."""
+    # Create a page first
+    r = client.post("/board/api/pages?section=Private&project=test/test")
+    assert r.status_code == 200
+    pid = r.json()["id"]
 
-    resp = client.post("/workspace/favorites", json={"collection_id": cid})
+    # Add to favorites
+    resp = client.post(f"/board/api/favorites/{pid}")
     assert resp.status_code == 200
+    assert resp.json()["status"] == "added"
 
-    favs = client.get("/workspace/favorites").json()["favorites"]
-    assert len(favs) >= 1
+    # List favorites
+    favs = client.get("/board/api/favorites").json()["favorites"]
+    assert pid in favs
 
-    fav_id = favs[0]["id"]
-    client.delete(f"/workspace/favorites/{fav_id}")
-    assert len(client.get("/workspace/favorites").json()["favorites"]) == 0
-    client.delete(f"/db/api/{cid}")
+    # Remove from favorites
+    resp = client.delete(f"/board/api/favorites/{pid}")
+    assert resp.status_code == 200
+    assert resp.json()["status"] == "removed"
+
+    # List should be empty
+    favs = client.get("/board/api/favorites").json()["favorites"]
+    assert pid not in favs
 
 
 def test_csv_import_export(client):