No TLS on the gRPC server; missing HTTP/2 connection hardening

Severity: high.

### Summary

The server is plaintext-only. `tonic` is built without any `tls-*` feature (`Cargo.toml:126`) and `serve()` sets no TLS config (`crates/node/src/node/grpc/mod.rs:117-126`). Note *contents* are encrypted, but tags, cursors, and note headers travel in cleartext and traffic can be MITM'd/tampered.

Separately, no HTTP/2 hardening is configured: no `max_concurrent_streams`, `http2_keepalive_interval`/`timeout`, `tcp_keepalive`, or header-read timeout. `accept_http1(true)` also enables grpc-web (HTTP/1.1), where slow-header/body trickle applies. The 4 s `TimeoutLayer` only covers a request *after* dispatch.

### Recommendation

- Either add tonic TLS config, or document a hard requirement for a TLS-terminating proxy and bind only to localhost/private interfaces by default.
- Set `max_concurrent_streams`, keepalive, and `tcp_keepalive` on the builder.

---
Part of #114.