fix: cap request bodies, link login error, add book-form retry, guard double add

Limit request bodies to 1 MiB (413 JSON), wire aria-describedby on the
login form, add Retry and cancellation to the book form load, disable
Add entry while a note POST is in flight, and poll pg_isready in README.

Claude-Session: https://claude.ai/code/session_01M9MLit5Ko3X4s7rzC5Kv7X

src/books/BookForm.test.tsx

@@ -62,4 +62,15 @@ describe('BookForm', () => {
       body: { title: 'Dune Messiah', author: 'Frank Herbert', genre_id: 5, total_pages: 380, current_page: 142 },
     })
   })
+
+  it('retries a failed load and shows the prefilled form', async () => {
+    let attempts = 0
+    signedIn({
+      'GET /api/books/7': () => (++attempts === 1 ? [500, { error: 'Database unavailable' }] : [200, dune]),
+    })
+    const user = renderApp('/books/7/edit')
+    expect(await screen.findByRole('alert')).toHaveTextContent('Database unavailable')
+    await user.click(screen.getByRole('button', { name: 'Retry' }))
+    expect(await screen.findByLabelText('Title')).toHaveValue('Dune')
+  })
 })