feat(mcp): agents can list, read and create notes

New scopes notes:read (list_notes, get_note, notes in search) and
notes:create (create_note from Markdown). MCP only, REST stays closed;
new notes go into shared folders only with write access.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/lib/apiScopes.ts

@@ -1,8 +1,9 @@
 import { ApiKeyScope } from './types';
 
 // What a key may do. The rights hold for every access alike: curl/REST and MCP for AI agents. The ids of
-// the delivering rights (webhook:…) stay from the time keys could only deliver data.
-export type ScopeGroup = 'tasks' | 'lists' | 'inbox';
+// the delivering rights (webhook:…) stay from the time keys could only deliver data. Notes are reachable
+// over MCP only.
+export type ScopeGroup = 'tasks' | 'lists' | 'notes' | 'inbox';
 export const SCOPES: { id: ApiKeyScope; label: string; chip: string; hint: string; group: ScopeGroup }[] = [
   { id: 'tasks:read', label: 'Lesen', chip: 'Aufgaben lesen', hint: 'Aufgabenlisten und Aufgaben lesen, suchen', group: 'tasks' },
   { id: 'webhook:task', label: 'Anlegen', chip: 'Aufgaben anlegen', hint: 'Nur neue Aufgaben anlegen', group: 'tasks' },
@@ -10,11 +11,14 @@ export const SCOPES: { id: ApiKeyScope; label: string; chip: string; hint: strin
   { id: 'lists:read', label: 'Lesen', chip: 'Listen lesen', hint: 'Listen und ihre Einträge lesen', group: 'lists' },
   { id: 'webhook:list', label: 'Einträge hinzufügen', chip: 'Listeneinträge hinzufügen', hint: 'Nur neue Einträge hinzufügen', group: 'lists' },
   { id: 'lists:write', label: 'Ändern', chip: 'Listen ändern', hint: 'Einträge hinzufügen, ändern und abhaken', group: 'lists' },
+  { id: 'notes:read', label: 'Lesen', chip: 'Notizen lesen', hint: 'Notizen auflisten, lesen, suchen (nur MCP)', group: 'notes' },
+  { id: 'notes:create', label: 'Anlegen', chip: 'Notizen anlegen', hint: 'Nur neue Notizen anlegen (nur MCP)', group: 'notes' },
   { id: 'webhook:triage', label: 'Inbox füllen', chip: 'Inbox', hint: 'Gedanken in die Inbox einliefern', group: 'inbox' },
 ];
 export const SCOPE_GROUPS: [ScopeGroup, string][] = [
   ['tasks', '📋 Aufgaben'],
   ['lists', '🛒 Listen'],
+  ['notes', '🗒️ Notizen'],
   ['inbox', '📥 Inbox'],
 ];
 export const scopeChip = (id: string) => SCOPES.find((s) => s.id === id)?.chip || id;

frontend/src/lib/types.ts

@@ -662,7 +662,7 @@ export interface UserTheme {
   updatedAt: string;
 }
 
-/** What an API key may do: webhook:* delivers data, the agent scopes read and change tasks/lists over MCP. */
+/** What an API key may do: webhook:* delivers data, the agent scopes read and change tasks/lists; notes only over MCP. */
 export type ApiKeyScope =
   | 'webhook:triage'
   | 'webhook:task'
@@ -670,7 +670,9 @@ export type ApiKeyScope =
   | 'tasks:read'
   | 'tasks:write'
   | 'lists:read'
-  | 'lists:write';
+  | 'lists:write'
+  | 'notes:read'
+  | 'notes:create';
 
 export interface APIKey {
   id: string;