feat(mcp): agents can list, read and create notes

New scopes notes:read (list_notes, get_note, notes in search) and
notes:create (create_note from Markdown). MCP only, REST stays closed;
new notes go into shared folders only with write access.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/storage/documents.go

@@ -256,6 +256,26 @@ func (s *Store) getUserFolderMounts(userID string) (map[string]string, map[strin
 
 // matchMountPath checks if folderPath falls within any mounted shared folder.
 // Returns (sharedFolderID, relativeSubPath, isMatch).
+// CheckCreateInFolder: new notes may go into own folders and into shared folders with write access.
+func (s *Store) CheckCreateInFolder(userID, folderPath string) error {
+	mounts, _, err := s.getUserFolderMounts(userID)
+	if err != nil {
+		return err
+	}
+	fID, _, ok := matchMountPath(folderPath, mounts)
+	if !ok {
+		return nil
+	}
+	sf, err := s.GetSharedFolderByID(userID, fID)
+	if err != nil {
+		return err
+	}
+	if sf.Permission != "owner" && sf.Permission != "write" && !sf.IsOwner {
+		return fmt.Errorf("im geteilten Ordner „%s“ darfst du nur lesen", sf.Name)
+	}
+	return nil
+}
+
 func matchMountPath(folderPath string, mounts map[string]string) (string, string, bool) {
 	clean := filepath.ToSlash(filepath.Clean(strings.TrimSpace(folderPath)))
 	if clean == "." {