notes: private Obsidian vault tracker at /trackers/notes

Vault files stay the source of truth (bind-mounted read-write at /notes):
atomic writes chowned to the vault owner, hash-checked saves (409 on a
newer file), deletes to .trash. notes.* is a full-text/link index kept
current by a recursive watcher plus a 60s rescan; live updates over the
owner-only /ws/notes channel (paths and hashes only). Wikilinks, embeds,
backlinks, tags, callouts, image paste. Owner-only everywhere (404).

src/routes/trackers/notes/+page.server.ts

@@ -0,0 +1,23 @@
+import { requireOwner } from '#lib/server/owner.js';
+import { backlinks } from '#lib/server/notes/indexer.js';
+import { readNote, VaultError } from '#lib/server/notes/vault.js';
+import { cleanVaultPath, kindOf } from '#lib/notes/shared.js';
+import type { PageServerLoad } from './$types';
+
+export const load: PageServerLoad = async (event) => {
+	requireOwner(event);
+	const path = cleanVaultPath(event.url.searchParams.get('note'));
+	if (!path || kindOf(path) === 'attachment')
+		return { note: null, missing: !!event.url.searchParams.get('note') };
+	try {
+		const note = await readNote(path);
+		return {
+			note: { path, ...note, backlinks: await backlinks(path).catch(() => []) },
+			missing: false
+		};
+	} catch (e) {
+		if (e instanceof VaultError && (e.status === 404 || e.status === 400))
+			return { note: null, missing: true };
+		throw e;
+	}
+};