Task #438: collaborative checklists + meeting alert animation parity

Backend
- New POST /notes/:id/checklist/:itemId/toggle endpoint. Owner or any
  active (non-archived) recipient can flip an item's done flag.
- Wrapped in a DB transaction with SELECT ... FOR UPDATE on the live
  note row so concurrent toggles from multiple collaborators can't
  lose each other's updates. Live notes.items + every
  note_recipients.items snapshot are mirrored atomically in the same
  tx.
- Emits note_checklist_changed to the audience minus the actor with
  the full updated items array so receivers can patch state without
  an extra fetch.

Frontend
- useToggleChecklistItem mutation hook with optimistic updates across
  notes/sent/received/thread caches and rollback on error.
- Incoming-note popup checklist is now interactive with a local
  override for instant visual feedback (popup renders from socket
  payload, not from the query cache).
- Thread checklist toggles are gated by effective permission (owner,
  admin, or non-archived recipient) to mirror server auth.
- Socket handler for note_checklist_changed invalidates relevant
  query keys AND patches the open popup payload directly via a new
  IncomingNotePopupContext.updateChecklistItems action so
  collaborators' open popups stay in sync.

Meeting alert animation parity (upcoming-meeting-alert.tsx)
- Added scale-95 -> scale-100 + fade entrance with the same spring
  cubic-bezier the note popup uses, retriggered per eligible meeting.
- Replaced the 1px border with a ring-4 colored frame driven by
  alertPrefs.accent (via boxShadow so the color is dynamic).
- Added an animate-ping accent halo around the drag-handle icon to
  match the popup's avatar pulse.

Tests
- artifacts/api-server/tests/notes-checklist-toggle.test.mjs (7 tests:
  owner/recipient toggle + mirroring, 403 non-recipient, 403
  archived, 400 non-checklist, 404 unknown item, 400 invalid body).
- artifacts/tx-os/tests/notes-popup-checklist-collab.spec.mjs (e2e:
  recipient ticks an item from the popup, server + sender snapshot
  both reflect the change).

Code review (architect) findings addressed:
- (critical) lost-update race -> tx with row lock.
- (critical) non-atomic snapshot mirror -> same tx.
- (critical) open popup didn't re-render on socket fanout ->
  updateChecklistItems context action.
- UI permission parity for archived recipients -> thread gates
  onToggle.

artifacts/tx-os/tests/notes-popup-checklist-collab.spec.mjs

@@ -149,7 +149,10 @@ test("recipient ticks a checklist item in the popup; sender sees the update", as
     expect(rows[0].items[0].done).toBe(true);
 
     // Sender's open notes page reflects the shared change after the
-    // socket fanout invalidates the cache.
+    // socket fanout invalidates the cache. We confirm both DB state
+    // (recipient snapshot mirrored) AND the sender-rendered card on
+    // their /notes page after a refresh — the latter is the actual UX
+    // promise of "everyone sees the same shared state".
     await expect
       .poll(
         async () =>
@@ -161,6 +164,13 @@ test("recipient ticks a checklist item in the popup; sender sees the update", as
         { timeout: 5_000 },
       )
       .toBe(true);
+
+    await senderPage.reload();
+    await expect(senderPage.getByTestId("notes-page")).toBeVisible();
+    const senderCard = senderPage.getByTestId(`note-card-${created.id}`);
+    await expect(senderCard).toBeVisible();
+    const senderCheckboxes = senderCard.locator('input[type="checkbox"]');
+    await expect(senderCheckboxes.first()).toBeChecked({ timeout: 5_000 });
   } finally {
     await senderCtx.close();
     await recipientCtx.close();