feat: personal notes on bill detail pages

- bill_notes table (migration 0014): user_id, bill_id, content, pinned,
  created_at, updated_at; unique constraint (user_id, bill_id)
- BillNote SQLAlchemy model with back-refs on User and Bill
- GET/PUT/DELETE /api/notes/{bill_id} — auth-required, one note per (user, bill)
- NotesPanel component: collapsible, auto-resize textarea, pin toggle,
  save + delete; shows last-saved date and pin indicator in collapsed header
- Pinned notes render above BriefPanel; unpinned render below DraftLetterPanel
- Guests see nothing (token guard in component + query disabled)

Co-Authored-By: Jack Levy

backend/alembic/versions/0014_add_bill_notes.py

@@ -0,0 +1,32 @@
+"""Add bill_notes table
+
+Revision ID: 0014
+Revises: 0013
+"""
+from alembic import op
+import sqlalchemy as sa
+
+revision = "0014"
+down_revision = "0013"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.create_table(
+        "bill_notes",
+        sa.Column("id", sa.Integer(), primary_key=True, autoincrement=True),
+        sa.Column("user_id", sa.Integer(), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("bill_id", sa.String(), sa.ForeignKey("bills.bill_id", ondelete="CASCADE"), nullable=False),
+        sa.Column("content", sa.Text(), nullable=False),
+        sa.Column("pinned", sa.Boolean(), nullable=False, server_default="false"),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now(), onupdate=sa.func.now()),
+        sa.UniqueConstraint("user_id", "bill_id", name="uq_bill_notes_user_bill"),
+    )
+    op.create_index("ix_bill_notes_user_id", "bill_notes", ["user_id"])
+    op.create_index("ix_bill_notes_bill_id", "bill_notes", ["bill_id"])
+
+
+def downgrade():
+    op.drop_table("bill_notes")