notes: color leaves the model, the wire and all three surfaces

Step 3 of M315, and the destructive half. Steps 1 and 2 stopped every read of
this field: a card is one neutral surface per theme, and the only coloured
thing on a board is a tag. What was left was a column written by a picker and
read by nothing.

Rule 22 — the old path comes out completely. No flag, no fallback, no
"override if set".

Server: the column, the `?color=` facet, the create/update/serialise paths,
the sync assignment, the front-matter line, and Keep's colour map. Alembic
0029 drops it and sweeps `"color"` out of stored saved-filter params — a view
that silently filtered on a field the app no longer has would return nothing
and never say why. That sweep is Python, not `params::jsonb - 'color'`,
because Postgres has no try-cast and one malformed blob would abort a
migration that is running over somebody's saved views.

`NOTE_COLORS` moves from `models/note.py` to `colors.py`. A palette defined on
the model that lost one is an invitation to put the column back; labels still
name a colour, so the vocabulary belongs where the normalizer already is.

Core: the field, the facet, the `NoteCreateInput`, and every read and write in
store/push/pull. Local schema v9 drops the column and does the same
saved-filter sweep, guarded on `json_valid` so a corrupt blob loses a key
rather than becoming NULL. The uniffi layer drops `NoteEdit::Color` and
`NoteDraft.color` with it.

Web: `ColorPicker.vue`, the per-card swatch popover and its stylesheet rule,
the FilterBar colour row, the facet in the query round-trip, and the colour
half of the editor's baseline-and-save. Android: the `ColorSheet`, the
`Picker.COLOR` case, the toolbar's swatch dot, `EditorAction.SetColor`.

## The protocol: v4, and the floor deliberately stays at 3

Checked against `compat.rs` and the push handler rather than trusting the
`#[serde(default)]` annotation, because the v2 precedent points the other way:
v2 dropped `kind` and `title` and DID raise both floors, on the rule that
dropping a field a client sends and expects back is breaking.

`color` fails the second half of that test. A v3 client reading a v4 note gets
`"default"` from its own serde default and draws the colour it derives
locally — the board it drew yesterday. A v3 client pushing `color` has the key
ignored, since `_assign_note_fields` reads its payload key by key and never
validates the shape. Neither direction errors and neither shows anything
wrong. `title` was the note's NAME; this is a field that no longer renders.

So `SYNC_PROTOCOL_VERSION` and `CLIENT_PROTOCOL_VERSION` go to 4, and both
floors stay at 3. `docs/sync.md` carries the reasoning and the per-version
history, and its push example is brought back in line — it still listed
`title`, `kind` and `items`, all gone before this.

Import stays tolerant: a pre-M315 export or a Keep takeout carrying `color:`
imports fine, the key simply read past. Old exports must still import.

#3041

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

core/src/sync/push.rs

@@ -64,6 +64,8 @@ pub struct Change {
 
     #[serde(skip_serializing_if = "Option::is_none")]
     pub body: Option<String>,
+    /// A LABEL's colour. A note has none since M315, so a note change leaves this
+    /// `None` and the key never reaches the wire.
     #[serde(skip_serializing_if = "Option::is_none")]
     pub color: Option<String>,
     #[serde(skip_serializing_if = "Option::is_none")]
@@ -220,7 +222,6 @@ fn collect_notes(conn: &Connection, out: &mut Vec<Change>, limit: usize) -> rusq
 /// field-to-column mapping stays readable at the call site.
 struct NoteRow {
     body: String,
-    color: String,
     position: i64,
     pinned: bool,
     archived: bool,
@@ -233,22 +234,21 @@ struct NoteRow {
 
 fn note_row(conn: &Connection, id: &str) -> rusqlite::Result<NoteRow> {
     conn.query_row(
-        "SELECT body, color, position, pinned, archived, trashed,
+        "SELECT body, position, pinned, archived, trashed,
                 remind_at, recurrence, created_at, updated_at
            FROM notes WHERE id = ?1",
         params![id],
         |r| {
             Ok(NoteRow {
                 body: r.get(0)?,
-                color: r.get(1)?,
-                position: r.get(2)?,
-                pinned: r.get::<_, i64>(3)? != 0,
-                archived: r.get::<_, i64>(4)? != 0,
-                trashed: r.get::<_, i64>(5)? != 0,
-                remind_at: r.get(6)?,
-                recurrence: r.get(7)?,
-                created_at: r.get(8)?,
-                updated_at: r.get(9)?,
+                position: r.get(1)?,
+                pinned: r.get::<_, i64>(2)? != 0,
+                archived: r.get::<_, i64>(3)? != 0,
+                trashed: r.get::<_, i64>(4)? != 0,
+                remind_at: r.get(5)?,
+                recurrence: r.get(6)?,
+                created_at: r.get(7)?,
+                updated_at: r.get(8)?,
             })
         },
     )
@@ -275,7 +275,8 @@ fn note_change(conn: &Connection, id: &str) -> rusqlite::Result<Change> {
         // server's last-write-wins comparison runs against.
         edited_at: row.updated_at,
         body: Some(row.body),
-        color: Some(row.color),
+        // A note has no colour to send. See the field on `Change`.
+        color: None,
         pinned: Some(row.pinned),
         archived: Some(row.archived),
         trashed: Some(row.trashed),
@@ -497,9 +498,9 @@ mod tests {
 
     fn seed_note(conn: &Connection, id: &str, dirty: i64) {
         conn.execute(
-            "INSERT INTO notes (id, body, color, position, pinned, archived,
+            "INSERT INTO notes (id, body, position, pinned, archived,
                                 trashed, created_at, updated_at, sync_revision, dirty)
-                  VALUES (?1, 'B', 'default', 0, 0, 0, 0,
+                  VALUES (?1, 'B', 0, 0, 0, 0,
                           '2026-07-26T00:00:00.000Z', '2026-07-26T00:00:00.000Z', 3, ?2)",
             params![id, dirty],
         )