refactor(notes): decompose Notes into feature-owned modules (#6713)

* refactor(notes): decompose Notes into feature-owned modules

* fix(notes): avoid HTML interpolation in reminder picker

* docs(notes): drop checkpoint archives, session logs and publication drafts

The N0-N6 tarballs and raw pytest/node logs are not read by any script or
test, and the logs carry absolute home-directory paths. Once squashed into
dev they would stay in history for good. notes-pr.md and notes-issue.md
were the drafts used to open #6712 and #6713, not documentation.

notes-validation.md keeps the counts, the checkpoint hashes and
implementation.sha256 as the record; local interpreter paths and the local
Docker image name are replaced with portable placeholders.

* fix(notes): keep the state store raw and stop masonry re-observing after close

- state: writes built from views (filter, spread, splice) stored nested
  read-only views in the store, so structuredClone on a stored note threw
  DataCloneError. Store writes now unwrap nested views.
- layout: a save that resolves after closePanel re-renders the leaving pane
  and re-created the masonry ResizeObserver that teardown had disposed.
  Skip creating it once Notes is closed.
- index.js: drop 30 imported or declared names that were never used and
  group the imports at the top. Import order is unchanged.
- Revert unrelated punctuation edits in .gitattributes and keep the header
  comment and docstring first in compare/vote.js and
  test_notes_dom_xss_helpers.py.

Both fixes have a node test that fails on the previous head.

* test(notes): make script rejection assertion case-insensitive

Address CodeQL js/bad-tag-filter alert #1150 in test-only assertion and refresh Notes evidence manifest checksum.

---------

Co-authored-by: Léo <leograndcontact@gmail.com>

static/js/features/notes/infrastructure/http.js

@@ -0,0 +1,29 @@
+/** Notes HTTP port. Response interpretation stays with the owning workflow. */
+export function createNotesApi({ origin, request }) {
+  const json = (method, body) => ({ method, credentials: 'same-origin', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(body) });
+  async function saveNote(note) {
+    const response = await request(note.id ? `${origin}/api/notes/${note.id}` : `${origin}/api/notes`, json(note.id ? 'PUT' : 'POST', note));
+    if (!response.ok) throw new Error('Failed to save note');
+    return await response.json();
+  }
+  async function patchNote(id, patch) {
+    const response = await request(`${origin}/api/notes/${id}`, json('PUT', patch));
+    if (!response.ok) throw new Error('Failed to update note');
+    return await response.json();
+  }
+  async function deleteNote(id) {
+    const response = await request(`${origin}/api/notes/${id}`, { method: 'DELETE', credentials: 'same-origin' });
+    if (!response.ok) throw new Error('HTTP ' + response.status);
+  }
+  return {
+    saveNote, patchNote, deleteNote,
+    listNotes: archived => request(`${origin}/api/notes${archived ? '?archived=true' : ''}`, { credentials: 'same-origin' }),
+    reorder: ids => request(`${origin}/api/notes/reorder`, json('POST', { ids })),
+    upload: body => request(`${origin}/api/upload`, { method: 'POST', body, credentials: 'same-origin' }),
+    uploadUrl: id => `${origin}/api/upload/${id}`,
+    fireReminder: body => request('/api/notes/fire-reminder', json('POST', body)),
+    defaultChat: () => request(`${origin}/api/default-chat`, { credentials: 'same-origin' }),
+    createSession: body => request(`${origin}/api/session`, { method: 'POST', body, credentials: 'same-origin' }),
+    startChat: body => request(`${origin}/api/chat_stream`, { method: 'POST', body, credentials: 'same-origin' }),
+  };
+}