notes: private Obsidian vault tracker at /trackers/notes

Vault files stay the source of truth (bind-mounted read-write at /notes):
atomic writes chowned to the vault owner, hash-checked saves (409 on a
newer file), deletes to .trash. notes.* is a full-text/link index kept
current by a recursive watcher plus a 60s rescan; live updates over the
owner-only /ws/notes channel (paths and hashes only). Wikilinks, embeds,
backlinks, tags, callouts, image paste. Owner-only everywhere (404).

src/lib/server/owner.ts

@@ -27,6 +27,8 @@ export const ownerOnlyPrefixes = [
 	'/trackers/houses',
 	'/trackers/data-holders',
 	'/trackers/books/files',
+	// Notes (the Obsidian vault): pages, API, attachments. The /ws/notes socket checks the owner itself.
+	'/trackers/notes',
 	// AI tracker: the news tab (/trackers/ai) is public, bots and usage are mine only.
 	'/trackers/ai/bots',
 	'/trackers/ai/usage',
@@ -62,6 +64,7 @@ export const ownerWritePrefixes = [
 	'/trackers/wildlife',
 	'/trackers/music',
 	'/trackers/pc',
+	'/trackers/notes',
 	'/trackers/ai',
 	'/trackers/movies'
 ] as const;