feat: implement notes CRUD for SQLite and API backends

Fills in all 7 previously-unimplemented note methods in SqliteInterface
and ApiInterface, adds cast/query helpers for notes, and fixes the
apirouter (missing updatenote validator, two /user/ → /users/ typos that
were also bypassing auth middleware).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

src/webapi/apirouter.ts

@@ -11,6 +11,7 @@ import {
   loginuser,
   updateabode,
   updateresident,
+  updatenote,
   updateuser,
 } from "../schema/validators.js";
 import { authenticate } from "./middleware/authenticate.js";
@@ -94,11 +95,11 @@ export function apirouter(db: BackendDbInterface): KoaRouter {
     await db.deleteApikeyById(ctx.params.kid);
     ctx.status = 204;
   });
-  router.post("/user/:uid/auth/clear-sessions", async (ctx) => {
+  router.post("/users/:uid/auth/clear-sessions", async (ctx) => {
     await db.deleteSessionsByUser(ctx.params.uid);
     ctx.status = 204;
   });
-  router.get("/user/:uid/notes", async (ctx) => {
+  router.get("/users/:uid/notes", async (ctx) => {
     ctx.body = await db.listNotesByUserId(ctx.params.uid);
   });
 
@@ -188,7 +189,7 @@ export function apirouter(db: BackendDbInterface): KoaRouter {
   });
   router.patch(
     "/notes/:nid",
-    jsonBody({ includeParams: ["nid"] }),
+    jsonBody({ validate: updatenote, includeParams: ["nid"] }),
     async (ctx) => {
       ctx.body = await db.updateNote(ctx.request.body, { uid: ctx.user!.uid });
     }