Task #402: Convert Notes into in-app messaging (independence fix)

Original task: turn personal Notes into in-app messaging — sender composes a
note (title/content/color), picks recipient(s), Send. Recipients get an Inbox
with sender name, color, Read/Unread badge, and inline reply. Sender sees
Sent Notes with per-recipient status. Sender's and recipient's copies must
be INDEPENDENT, with proper backend access checks (admin sees everything),
realtime updates, and full i18n + RTL.

Initial implementation review FAILED because the recipient view still read
from the sender's notes table, so sender edits/deletes mutated recipient
copies. This commit completes the fix:

- Schema (lib/db/src/schema/notes.ts): added immutable snapshot columns
  (title/content/color) on note_recipients; dropped the FK on
  note_recipients.note_id and note_replies.note_id and made them plain
  integers so recipient threads survive the sender deleting their note.
- Routes (artifacts/api-server/src/routes/notes.ts):
  - /notes/received and /notes/:id/thread now serve the recipient snapshot
    (sender/admin still see the live note).
  - /notes/:id/reply derives the owner from note_recipients.senderUserId
    so it works after sender deletion, clears archivedAt, and bumps
    status to "replied".
  - /notes/sent filters out null noteIds.
- Tests (artifacts/api-server/tests/notes-share.test.mjs): added
  snapshot-independence test (sender edit + delete must not mutate
  recipient copy; thread + reply still work after sender delete) and
  archived-reply-clears-archivedAt test. All 5 backend tests pass; the
  existing notes-inbox e2e still passes.
- Architect review: PASS (conditional only on the schema migration being
  applied, which has been pushed via `pnpm --filter @workspace/db push`).

Pre-existing executive-meetings TS errors and the failing `test` workflow
are unrelated to this task.

lib/db/src/schema/notes.ts

@@ -31,6 +31,46 @@ export const noteLabelAssignmentsTable = pgTable("note_label_assignments", {
   pk: primaryKey({ columns: [t.noteId, t.labelId] }),
 }));
 
+/**
+ * Per-recipient delivery row for a note that was sent from one user
+ * (`senderUserId` / the owning `notes.user_id`) to another
+ * (`recipientUserId`). One row is created per recipient at send time.
+ *
+ * Status lifecycle: `unread` -> `read` (recipient opens) -> `replied`
+ * (recipient sends a reply). `archived` is recipient-side only and does
+ * not affect the sender's view.
+ */
+export const noteRecipientsTable = pgTable("note_recipients", {
+  id: serial("id").primaryKey(),
+  // The original sender-side note id at send time. Stored as a plain integer
+  // (no FK) so the recipient row — and the thread it anchors — survives the
+  // sender deleting their own note. Together with the snapshot fields below
+  // this guarantees recipient copies are fully independent of sender edits.
+  noteId: integer("note_id").notNull(),
+  senderUserId: integer("sender_user_id").notNull().references(() => usersTable.id, { onDelete: "cascade" }),
+  recipientUserId: integer("recipient_user_id").notNull().references(() => usersTable.id, { onDelete: "cascade" }),
+  // Immutable snapshot of the note as it was at send time. Sender edits to the
+  // original note do NOT propagate to delivered copies.
+  title: varchar("title", { length: 300 }).notNull().default(""),
+  content: text("content").notNull().default(""),
+  color: varchar("color", { length: 32 }).notNull().default("default"),
+  status: varchar("status", { length: 16 }).notNull().default("unread"),
+  sentAt: timestamp("sent_at", { withTimezone: true }).notNull().defaultNow(),
+  readAt: timestamp("read_at", { withTimezone: true }),
+  archivedAt: timestamp("archived_at", { withTimezone: true }),
+}, (t) => ({
+  noteRecipientUnique: uniqueIndex("note_recipients_note_recipient_unique").on(t.noteId, t.recipientUserId),
+}));
+
+export const noteRepliesTable = pgTable("note_replies", {
+  id: serial("id").primaryKey(),
+  noteId: integer("note_id").notNull(),
+  senderUserId: integer("sender_user_id").notNull().references(() => usersTable.id, { onDelete: "cascade" }),
+  recipientUserId: integer("recipient_user_id").notNull().references(() => usersTable.id, { onDelete: "cascade" }),
+  content: text("content").notNull(),
+  createdAt: timestamp("created_at", { withTimezone: true }).notNull().defaultNow(),
+});
+
 export const insertNoteSchema = createInsertSchema(notesTable).omit({ id: true, createdAt: true, updatedAt: true });
 export type InsertNote = z.infer<typeof insertNoteSchema>;
 export type Note = typeof notesTable.$inferSelect;
@@ -38,3 +78,6 @@ export type Note = typeof notesTable.$inferSelect;
 export const insertNoteLabelSchema = createInsertSchema(noteLabelsTable).omit({ id: true, createdAt: true });
 export type InsertNoteLabel = z.infer<typeof insertNoteLabelSchema>;
 export type NoteLabel = typeof noteLabelsTable.$inferSelect;
+
+export type NoteRecipient = typeof noteRecipientsTable.$inferSelect;
+export type NoteReply = typeof noteRepliesTable.$inferSelect;