M2 labels backend: labels + note_labels, CRUD, note-label set, filter

- Label + NoteLabel models; migration 0004 (labels unique per owner + note_labels
  join, cascade).
- /api/labels: list/create(idempotent)/rename(clash-checked)/delete, owner-scoped.
- PUT /api/notes/<id>/labels to set a note's labels (validated against owned).
- Note responses now include labels[] (merged via one explicit join query — no
  lazy relationship); GET /api/notes?...&label=<id> filters by label.
- DB-free auth-guard tests for labels endpoints.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

src/thoughtsync/app.py

@@ -10,6 +10,7 @@ from . import __version__
 from .auth import bp as auth_bp
 from .config import Config
 from .db import session_scope
+from .labels import bp as labels_bp
 from .notes import bp as notes_bp
 from .settings import get_public_config, get_setting, load_or_create_secret_key
 from .settings_api import bp as settings_bp
@@ -30,6 +31,7 @@ def create_app() -> Quart:
 
     app.register_blueprint(auth_bp)
     app.register_blueprint(notes_bp)
+    app.register_blueprint(labels_bp)
     app.register_blueprint(settings_bp)
 
     @app.before_serving