server: one credential check, one coerce_bool, one top-position query, and the shared response helpers

From the audit (#5179, server half).

- auth: login and device-login share _check_credentials (dummy hash for a
  missing account, throttle bookkeeping, the failure log line) and
  _bad_credentials.
- settings uses common.coerce_bool. Its private copy differed only in
  treating a non-string as its truthiness, which the shared one now does.
- notes: create and import share helpers.top_position.
- auth, settings_api, sync and client_dist return errors through
  responses.json_error / not_found, and parse ids with parse_uuid.
- sync: push replies are built by _result(id, entity, status, **extra).

Already merged by earlier steps, so nothing to do here: attachment storage
(store_attachment), the preview upsert (only unfurl_queue writes one now),
and _serialize_note (delegates to _serialize_notes).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

tests/test_notes.py

@@ -375,6 +375,8 @@ def test_coerce_bool():
     assert not coerce_bool(None)
     assert not coerce_bool("")
     assert not coerce_bool(False)
+    # A bool setting can arrive as a JSON number.
+    assert coerce_bool(1) and not coerce_bool(0)
 
 
 def test_normalize_recurrence():