refactor(notes): decompose Notes into feature-owned modules (#6713)

* refactor(notes): decompose Notes into feature-owned modules

* fix(notes): avoid HTML interpolation in reminder picker

* docs(notes): drop checkpoint archives, session logs and publication drafts

The N0-N6 tarballs and raw pytest/node logs are not read by any script or
test, and the logs carry absolute home-directory paths. Once squashed into
dev they would stay in history for good. notes-pr.md and notes-issue.md
were the drafts used to open #6712 and #6713, not documentation.

notes-validation.md keeps the counts, the checkpoint hashes and
implementation.sha256 as the record; local interpreter paths and the local
Docker image name are replaced with portable placeholders.

* fix(notes): keep the state store raw and stop masonry re-observing after close

- state: writes built from views (filter, spread, splice) stored nested
  read-only views in the store, so structuredClone on a stored note threw
  DataCloneError. Store writes now unwrap nested views.
- layout: a save that resolves after closePanel re-renders the leaving pane
  and re-created the masonry ResizeObserver that teardown had disposed.
  Skip creating it once Notes is closed.
- index.js: drop 30 imported or declared names that were never used and
  group the imports at the top. Import order is unchanged.
- Revert unrelated punctuation edits in .gitattributes and keep the header
  comment and docstring first in compare/vote.js and
  test_notes_dom_xss_helpers.py.

Both fixes have a node test that fails on the previous head.

* test(notes): make script rejection assertion case-insensitive

Address CodeQL js/bad-tag-filter alert #1150 in test-only assertion and refresh Notes evidence manifest checksum.

---------

Co-authored-by: Léo <leograndcontact@gmail.com>

scripts/verify_frontend_runtime.py

@@ -1,6 +1,7 @@
 #!/usr/bin/env python3
 """Verify the current Python runtime from an isolated distribution without frontend tooling."""
 import os
+import json
 from pathlib import Path
 import shutil
 import socket
@@ -13,12 +14,20 @@ ROOT = Path(__file__).resolve().parents[1]
 PROBE = """
 from pathlib import Path
 import shutil
+import json
+import sys
 from starlette.testclient import TestClient
 from app import app
 assert not Path('frontend').exists()
 assert not Path('node_modules').exists()
 assert shutil.which('node') is None
 with TestClient(app) as client:
+    for output in json.loads(sys.argv[1]):
+        asset = client.get('/static/' + output)
+        assert asset.status_code == 200, (output, asset.status_code)
+        assert asset.content == Path('static', output).read_bytes(), output
+        assert asset.headers['content-type'].startswith('text/javascript'), output
+        assert asset.headers['cache-control'] == 'no-cache', output
     response = client.get('/static/js/actionMenuOrder.js')
     assert response.status_code == 200, response.status_code
     assert response.content == Path('static/js/actionMenuOrder.js').read_bytes()
@@ -58,7 +67,10 @@ def main() -> int:
         )
         # A caller's Python search path must not import the original checkout.
         env.pop("PYTHONPATH", None)
-        result = subprocess.run([sys.executable, "-c", PROBE], cwd=target, env=env, capture_output=True, text=True, timeout=60)
+        outputs = [entry['deployment'] for entry in json.loads(
+            (ROOT / 'frontend/modules.json').read_text(encoding='utf-8')
+        )['modules']]
+        result = subprocess.run([sys.executable, "-c", PROBE, json.dumps(outputs)], cwd=target, env=env, capture_output=True, text=True, timeout=60)
         print(result.stdout, end="")
         if result.returncode:
             print(result.stderr[-8000:], file=sys.stderr)