M6 1902a: richer facet query + saved-filters storage (backend)

GET /api/notes gains combinable, AND-ed facets alongside the existing
filter/date/sort: multiple ?label= (notes with ALL), ?color, ?kind,
?has_reminder, ?has_attachment, and ?q (full-text over title+body, ranked)
— so the facet bar's text box searches, not just filters. All optional;
invalid color/kind → 400.

saved_filters table (migration 0021) + /api/saved-filters CRUD (list /
create / rename+repoint / delete, owner-scoped). `params` is a JSON facet
dict mirroring the query surface; clean_params() whitelists facet keys so a
saved view can't accumulate junk.

Tests (DB-free): _truthy, clean_params key-whitelisting, saved-filters
auth-guards. UI (facet bar + saved-views sidebar) lands next.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

tests/test_notes.py

@@ -6,6 +6,7 @@ from thoughtsync.notes import (
     _attachment_ext,
     _escape_like,
     _header_filename,
+    _truthy,
     _keep_spec,
     _native_spec,
     _parse_iso_dt,
@@ -259,6 +260,13 @@ def test_header_filename():
     assert _header_filename("") == "file"
 
 
+def test_truthy():
+    assert _truthy("true") and _truthy("1") and _truthy("yes") and _truthy("on")
+    assert not _truthy("false")
+    assert not _truthy(None)
+    assert not _truthy("")
+
+
 def test_usec_to_dt():
     # Google Keep timestamps are microseconds since the epoch (UTC).
     d = _usec_to_dt(1600000000000000)