M3 graph view: /api/graph + force-directed SVG

- graph blueprint: GET /api/graph resolves note_links to target notes by
  normalized title (owner-scoped, non-trashed, self-excluded) → {nodes, edges}
  of connected notes.
- GraphView: hand-rolled force simulation (repulsion + edge springs + centering,
  cooling over ~400 frames), SVG nodes/edges, click a node to open it (reuses the
  editor with link navigation). Sidebar Graph entry + route; empty state.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

tests/test_notes.py

@@ -90,3 +90,9 @@ async def test_titles_requires_auth(app):
     client = app.test_client()
     resp = await client.get("/api/notes/titles")
     assert resp.status_code == 401
+
+
+async def test_graph_requires_auth(app):
+    client = app.test_client()
+    resp = await client.get("/api/graph")
+    assert resp.status_code == 401