v1.5.3: Fix write pipeline, WAL concurrency, --read-only mode

[devwhodevs]

Summary

• Auto-link resolver: skip code blocks, inline code, frontmatter, filenames with extensions, and bare date patterns (YYYY-MM-DD)
• Frontmatter merge: user-provided FM fields merged into auto-generated block instead of creating duplicate FM sections
• Title extraction: reads title field from frontmatter, skips FM delimiters
• Link application: create_note now uses apply_links() with protected regions instead of manual replacement
• mtime sync: update stored mtime after edit/rewrite operations to prevent false conflict errors
• WAL mode: SQLite WAL journal + 5s busy_timeout for concurrent MCP + CLI access
• --read-only flag: engraph serve --read-only disables all write MCP and HTTP tools

Test plan

• 450 unit tests passing (up from 426)
• CLI create with FM + code blocks + dates: all protections verified
• CLI edit → append: no mtime conflict
• HTTP create: FM merge, link protection, date skip all working
• HTTP edit → append: no mtime conflict
• HTTP read-only: write returns 403, search still works
• Release build: clean, no warnings