feat: add Note model, CRUD API, and per-player authorization rules (#20)

[onurege3467]

Closes #20

Summary

Adds the Note model, CRUD API endpoints, and server-side authorization rules for per-player note visibility in campaigns.

Changes

Backend (be/)

• New model: Note with fields for id, campaign, owner, title, content, visibility (personal or players), parent_id, and timestamps. The note_permissions cross-reference table links notes to permitted users.
• New service: NotesService with authorization-aware CRUD:
  • can_manage_notes — only the campaign owner (DM) can create/update/delete notes
  • can_view_note — DM sees all; players see only notes with visibility='players' that they are explicitly permitted to view
  • get_notes — DM sees all campaign notes; players see only their permitted subset
  • set_note_permissions — DM assigns which players can see a note (replaces membership)
  • to_dict — the permitted_user_ids field is only included for the DM owner
• New controller: REST endpoints following existing project patterns:
  • GET /api/campaigns/:id/notes — list visible notes
  • POST /api/campaigns/:id/notes — create note (DM only)
  • GET /api/notes/:id — single note
  • PUT /api/notes/:id — update note (DM only)
  • DELETE /api/notes/:id — delete note (DM only)
  • PUT /api/notes/:id/permissions — set player access (DM only)
• Tests: 9 integration tests covering creation, authorization, visibility filtering, permission management, update, delete, and info hiding
• Registration: Note model, blueprints registered in app factory and model init

Verification

• All project Python files pass py_compile syntax check
• Integration test verified manually: DM creates personal + player notes, grants per-player access, players see only permitted notes, unauthorized access correctly denied, info hiding works

Notes

• Frontend integration for hiding UI controls (AC Authorization rules for players notes #20 item 1) is a separate follow-up once the frontend note components (Implement notes tree with "Personal notes" and "Player notes" sections #16, Simple Markdown textarea editor with Save and Cancel #17) are built
• The Note model follows the spec from Backend API and storage for notes #18 (id, title, content, ownerId, visibility, timestamps, parentId) and adds the authorization layer from Authorization rules for players notes #20