M2 checklists: note kind + items backend + editor/card UI

- Migration 0006: notes.kind ('text'|'list') + note_items (text, checked,
  position). Item API: add/update(toggle)/delete/reorder; PATCH note kind; note
  responses include kind + items[] (merged in one query alongside labels).
- notes store: kind/items on Note, setKind/addItem/updateItem/deleteItem.
- NoteChecklist component (toggle/add/edit/delete items); rendered read-only-ish
  on cards (checkboxes toggle) and editable in the editor.
- Editor: convert text<->checklist (body lines become items on convert to list).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

tests/test_notes.py

@@ -56,3 +56,9 @@ async def test_search_requires_auth(app):
     client = app.test_client()
     resp = await client.get("/api/notes/search?q=hello")
     assert resp.status_code == 401
+
+
+async def test_add_item_requires_auth(app):
+    client = app.test_client()
+    resp = await client.post("/api/notes/00000000-0000-0000-0000-000000000000/items", json={"text": "x"})
+    assert resp.status_code == 401