fix(annotations): address code review findings (1-8, 10)

1. toggleVote wrapped in transaction (race condition fix)
2. FeedbackPanel fetch calls now surface errors via onError/toast
3. Extracted resolveBoard/hasCollectionRole to shared board-access.js
4. AnnotationStore uses monotonic version counter for snapshots
5. PinOverlay uses object pool instead of destroy/recreate on refresh
6. canvasObjects prop memoized with useMemo
7. PinOverlay store subscription cleaned up on unmount
8. Comment content capped at 5000 chars (backend validation)
10. anchor_type validated to 'object' or 'point'

backend/db.js

@@ -534,7 +534,7 @@ function getVotesByBoard(boardId) {
   return db.prepare('SELECT * FROM object_votes WHERE board_id = ?').all(boardId);
 }
 
-function toggleVote(boardId, objectId, userId) {
+const _toggleVoteTx = db.transaction((boardId, objectId, userId) => {
   const existing = db.prepare(
     'SELECT 1 FROM object_votes WHERE board_id = ? AND object_id = ? AND user_id = ?'
   ).get(boardId, objectId, userId);
@@ -548,6 +548,10 @@ function toggleVote(boardId, objectId, userId) {
       .run(boardId, objectId, userId);
     return true; // vote added
   }
+});
+
+function toggleVote(boardId, objectId, userId) {
+  return _toggleVoteTx(boardId, objectId, userId);
 }
 
 // ---------------------