notes: private Obsidian vault tracker at /trackers/notes

Vault files stay the source of truth (bind-mounted read-write at /notes):
atomic writes chowned to the vault owner, hash-checked saves (409 on a
newer file), deletes to .trash. notes.* is a full-text/link index kept
current by a recursive watcher plus a 60s rescan; live updates over the
owner-only /ws/notes channel (paths and hashes only). Wikilinks, embeds,
backlinks, tags, callouts, image paste. Owner-only everywhere (404).

README.md

@@ -342,6 +342,28 @@ registered callback URL. The integration follows the installed Better Auth APIs;
 see [SvelteKit integration](https://better-auth.com/docs/integrations/svelte-kit)
 and [Generic OAuth](https://better-auth.com/docs/plugins/generic-oauth).
 
+## Notes
+
+`/trackers/notes` (owner-only, always: every page, API, attachment and the `/ws/notes` socket 404s
+for anyone else) is a web editor for Stan's Obsidian vault, two-way and near-real-time.
+
+- **Source of truth:** the markdown files in `~/obsidian-vault` on the server (Syncthing folder
+  `obsidian-vault`, synced to his devices), bind-mounted read-write at `/notes` by
+  `scripts/deploy-remote.sh` (`NOTES_HOST_DIR`). The site reads and writes `.md` files directly:
+  atomic writes (hidden `.notes-tmp-*` file in the same folder, fsync, rename), chowned to the
+  vault owner, frontmatter and everything else kept byte-for-byte. Deleting moves the file to
+  `<vault>/.trash` like Obsidian does.
+- **Index only:** `notes.files` / `notes.links` (full-text search, tags, wikilinks, backlinks) are
+  rebuilt from the files by `src/lib/server/notes/indexer.ts`: recursive `fs.watch` plus a full
+  rescan every minute. Dropping the tables loses nothing.
+- **Live:** file changes (from Obsidian via Syncthing, or the site) are pushed to open pages over
+  `wss://stanrunge.dev/ws/notes` (paths and hashes only, never content). Saves carry the hash the
+  editor loaded; if the file changed in between the save is refused (409) and the page offers
+  load theirs / overwrite / save a copy.
+- **Ignored:** anything under a dot entry (`.obsidian`, `.trash`, `.stfolder`, `.stversions`,
+  `.DS_Store`, Syncthing temps). `*.sync-conflict-*` files are listed as warnings, not indexed.
+- Syncthing should ignore the site's write temps: `(?d).notes-tmp-*` in the vault's `.stignore`.
+
 ## Development
 
 There are two environments: local dev and production. Prod is the source of truth