feat(mcp): agents can list, read and create notes

New scopes notes:read (list_notes, get_note, notes in search) and
notes:create (create_note from Markdown). MCP only, REST stays closed;
new notes go into shared folders only with write access.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/storage/apikeys.go

@@ -12,7 +12,7 @@ import (
 
 // Rights of an API key. They hold the same over every access: REST (curl, smart home) and the MCP
 // endpoint for AI agents. The ids of the first three come from the time they only delivered data
-// (webhooks) and stay for existing keys. Notes are never reachable with a key.
+// (webhooks) and stay for existing keys. Notes are reachable over MCP only, never over REST.
 const (
 	ScopeTriage = "webhook:triage" // thoughts into the inbox
 	ScopeTask   = "webhook:task"   // create tasks
@@ -22,10 +22,14 @@ const (
 	ScopeTasksWrite = "tasks:write" // create, change, complete and delete tasks
 	ScopeListsRead  = "lists:read"  // lists and their items
 	ScopeListsWrite = "lists:write" // add, change and check off items
+
+	ScopeNotesRead   = "notes:read"   // notes and their bullets (MCP only)
+	ScopeNotesCreate = "notes:create" // create new notes (MCP only); existing ones stay untouched
 )
 
 // AllScopes in display order.
-var AllScopes = []string{ScopeTriage, ScopeTask, ScopeList, ScopeTasksRead, ScopeTasksWrite, ScopeListsRead, ScopeListsWrite}
+var AllScopes = []string{ScopeTriage, ScopeTask, ScopeList, ScopeTasksRead, ScopeTasksWrite, ScopeListsRead, ScopeListsWrite,
+	ScopeNotesRead, ScopeNotesCreate}
 
 // NormalizeScopes keeps the known scopes in a fixed order; none at all means triage only.
 func NormalizeScopes(scopes []string) []string {