Rework category labels, slug validation, and task-list checkboxes

- Remove the section-header ➕ "add landing page" button; landing pages are
  now created via the page editor pen.
- Treat saving a page with empty (after stripping) Markdown as deleting it:
  childless nodes are removed, nodes with children become content-less labels.
- Restrict server-side slugs to [a-z0-9_-] with no leading underscore or dot;
  drop the reserved-filename blacklist.
- Render placeholder pages for content-less category labels and link them to
  their first published child in the navigation.
- Make task-list checkboxes live, non-disabled inputs: toggling updates the
  Markdown source, updates the open CodeMirror document when the page editor is
  open, and persists to the server when no editor is open. Errors revert the UI.
- Update docs and AGENTS.md conventions accordingly.

docs/design-principles.md

@@ -32,11 +32,10 @@ evolves.
   lives under `/_/` (the API at `/_/api/`, uploaded files at `/_/f/`, built
   assets at `/_/assets/`, and the admin shell at `/_/admin`). The only
   other reserved root path is `/favicon.ico`, served from the build.
-  Slugs are lowercase ASCII (`[a-z0-9-]`; input is transliterated and
-  filtered as you type, and a new page's empty slug is derived from its
-  title), may not begin with `_` or `.`, and may not occupy a reserved
-  root file name (`robots.txt`, `sitemap.xml`, `favicon.ico`, …) — such
-  URLs are never looked up as content.
+  Slugs are lowercase ASCII letters, digits, hyphens and underscores
+  (`[a-z0-9_-]`; input is transliterated and filtered as you type, and a
+  new page's empty slug is derived from its title), may not begin with
+  `_` or `.`, and such URLs are never looked up as content.
 - **Single user, trusted author.** No auth concerns in the core design.
   Everything published is public; only editing tools will later sit behind
   access control (external SSO when that time comes). The author is trusted
@@ -105,9 +104,11 @@ evolves.
   the sidebar is empty (and hidden) elsewhere. Other sections' subitems
   are never shown without navigating into them first.
 - **Landing pages are optional.** Every label can either have content
-  (`Node.content`, a Markdown page) or none — a content-less label
-  redirects to its first child instead of 404ing, so categories need no
-  filler content. Title and slug of every label are editable; renaming a
+  (`Node.content`, a Markdown page) or none — a content-less label renders
+  a placeholder page (404 with a pen to create it) instead of redirecting,
+  while nav links to it point straight at its first child, so categories
+  need no filler content and normal navigation never sees the placeholder.
+  Title and slug of every label are editable; renaming a
   slug moves the whole subtree. The sidebar never lists the section
   itself, avoiding title duplication with the navbar.
 - **Menu order is manual.** Each node has a fractional `order` key among