M1: notes model + migration 0002 + notes API (CRUD, trash/restore)

- Note model (owner_id, title, body, color-key, pinned, archived, deleted_at
  soft-delete, timestamps) + board index; NOTE_COLORS palette keys.
- Migration 0002 (notes table + ix_notes_owner_board).
- /api/notes blueprint (login_required): list (?filter=active|archived|trash,
  pinned-then-updated, read via visible_to_user ACL), create, get, patch
  (title/body/color/pinned/archived), trash, restore, permanent delete
  (trash-only). Mutations owner-scoped; empty note rejected (400).
- DB-free unit tests: is_empty_note, normalize_color, palette, serialize,
  auth-guard on list/create.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01FRgehjoz7Yv8LkUfADxACm

tests/test_notes.py

@@ -0,0 +1,52 @@
+import pytest
+
+from thoughtsync.app import create_app
+from thoughtsync.models.note import NOTE_COLORS, Note
+from thoughtsync.notes import is_empty_note, normalize_color
+
+
+@pytest.fixture
+def app():
+    return create_app()
+
+
+def test_is_empty_note():
+    assert is_empty_note(None, None)
+    assert is_empty_note("", "   ")
+    assert not is_empty_note("title", "")
+    assert not is_empty_note("", "body")
+
+
+def test_normalize_color():
+    assert normalize_color("blue") == "blue"
+    assert normalize_color("chartreuse") == "default"
+    assert normalize_color(None) == "default"
+    assert normalize_color(123) == "default"
+
+
+def test_palette_has_core_colors():
+    for c in ("default", "red", "orange", "yellow", "green", "teal", "blue", "purple", "pink", "gray"):
+        assert c in NOTE_COLORS
+
+
+def test_serialize_shape():
+    n = Note(title="t", body="b", color="blue", pinned=True, archived=False)
+    s = n.serialize()
+    assert s["title"] == "t"
+    assert s["body"] == "b"
+    assert s["color"] == "blue"
+    assert s["pinned"] is True
+    assert s["archived"] is False
+    assert s["trashed"] is False
+
+
+async def test_notes_list_requires_auth(app):
+    client = app.test_client()
+    resp = await client.get("/api/notes")
+    assert resp.status_code == 401
+
+
+async def test_notes_create_requires_auth(app):
+    client = app.test_client()
+    resp = await client.post("/api/notes", json={"body": "hi"})
+    assert resp.status_code == 401