feat: personal notes on bill detail pages

- bill_notes table (migration 0014): user_id, bill_id, content, pinned,
  created_at, updated_at; unique constraint (user_id, bill_id)
- BillNote SQLAlchemy model with back-refs on User and Bill
- GET/PUT/DELETE /api/notes/{bill_id} — auth-required, one note per (user, bill)
- NotesPanel component: collapsible, auto-resize textarea, pin toggle,
  save + delete; shows last-saved date and pin indicator in collapsed header
- Pinned notes render above BriefPanel; unpinned render below DraftLetterPanel
- Guests see nothing (token guard in component + query disabled)

Co-Authored-By: Jack Levy

backend/app/api/notes.py

@@ -0,0 +1,89 @@
+"""
+Bill Notes API — private per-user notes on individual bills.
+One note per (user, bill). PUT upserts, DELETE removes.
+"""
+from fastapi import APIRouter, Depends, HTTPException
+from sqlalchemy import select
+from sqlalchemy.ext.asyncio import AsyncSession
+
+from app.core.dependencies import get_current_user
+from app.database import get_db
+from app.models.bill import Bill
+from app.models.note import BillNote
+from app.models.user import User
+from app.schemas.schemas import BillNoteSchema, BillNoteUpsert
+
+router = APIRouter()
+
+
+@router.get("/{bill_id}", response_model=BillNoteSchema)
+async def get_note(
+    bill_id: str,
+    current_user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    result = await db.execute(
+        select(BillNote).where(
+            BillNote.user_id == current_user.id,
+            BillNote.bill_id == bill_id,
+        )
+    )
+    note = result.scalar_one_or_none()
+    if not note:
+        raise HTTPException(status_code=404, detail="No note for this bill")
+    return note
+
+
+@router.put("/{bill_id}", response_model=BillNoteSchema)
+async def upsert_note(
+    bill_id: str,
+    body: BillNoteUpsert,
+    current_user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    bill = await db.get(Bill, bill_id)
+    if not bill:
+        raise HTTPException(status_code=404, detail="Bill not found")
+
+    result = await db.execute(
+        select(BillNote).where(
+            BillNote.user_id == current_user.id,
+            BillNote.bill_id == bill_id,
+        )
+    )
+    note = result.scalar_one_or_none()
+
+    if note:
+        note.content = body.content
+        note.pinned = body.pinned
+    else:
+        note = BillNote(
+            user_id=current_user.id,
+            bill_id=bill_id,
+            content=body.content,
+            pinned=body.pinned,
+        )
+        db.add(note)
+
+    await db.commit()
+    await db.refresh(note)
+    return note
+
+
+@router.delete("/{bill_id}", status_code=204)
+async def delete_note(
+    bill_id: str,
+    current_user: User = Depends(get_current_user),
+    db: AsyncSession = Depends(get_db),
+):
+    result = await db.execute(
+        select(BillNote).where(
+            BillNote.user_id == current_user.id,
+            BillNote.bill_id == bill_id,
+        )
+    )
+    note = result.scalar_one_or_none()
+    if not note:
+        raise HTTPException(status_code=404, detail="No note for this bill")
+    await db.delete(note)
+    await db.commit()

backend/app/main.py

@@ -1,7 +1,7 @@
 from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 
-from app.api import bills, members, follows, dashboard, search, settings, admin, health, auth, notifications
+from app.api import bills, members, follows, dashboard, search, settings, admin, health, auth, notifications, notes
 from app.config import settings as config
 
 app = FastAPI(
@@ -28,3 +28,4 @@ app.include_router(settings.router, prefix="/api/settings", tags=["settings"])
 app.include_router(admin.router, prefix="/api/admin", tags=["admin"])
 app.include_router(health.router, prefix="/api/health", tags=["health"])
 app.include_router(notifications.router, prefix="/api/notifications", tags=["notifications"])
+app.include_router(notes.router, prefix="/api/notes", tags=["notes"])

backend/app/models/__init__.py

@@ -4,6 +4,7 @@ from app.models.follow import Follow
 from app.models.member import Member
 from app.models.member_interest import MemberTrendScore, MemberNewsArticle
 from app.models.news import NewsArticle
+from app.models.note import BillNote
 from app.models.notification import NotificationEvent
 from app.models.setting import AppSetting
 from app.models.trend import TrendScore
@@ -15,6 +16,7 @@ __all__ = [
     "BillAction",
     "BillDocument",
     "BillBrief",
+    "BillNote",
     "Follow",
     "Member",
     "MemberTrendScore",

backend/app/models/bill.py

@@ -39,6 +39,7 @@ class Bill(Base):
     news_articles = relationship("NewsArticle", back_populates="bill", order_by="desc(NewsArticle.published_at)")
     trend_scores = relationship("TrendScore", back_populates="bill", order_by="desc(TrendScore.score_date)")
     committee_bills = relationship("CommitteeBill", back_populates="bill")
+    notes = relationship("BillNote", back_populates="bill", cascade="all, delete-orphan")
 
     __table_args__ = (
         Index("ix_bills_congress_number", "congress_number"),

backend/app/models/note.py

@@ -0,0 +1,26 @@
+from sqlalchemy import Boolean, Column, DateTime, ForeignKey, Index, Integer, String, Text, UniqueConstraint
+from sqlalchemy.orm import relationship
+from sqlalchemy.sql import func
+
+from app.database import Base
+
+
+class BillNote(Base):
+    __tablename__ = "bill_notes"
+
+    id = Column(Integer, primary_key=True, autoincrement=True)
+    user_id = Column(Integer, ForeignKey("users.id", ondelete="CASCADE"), nullable=False)
+    bill_id = Column(String, ForeignKey("bills.bill_id", ondelete="CASCADE"), nullable=False)
+    content = Column(Text, nullable=False)
+    pinned = Column(Boolean, nullable=False, default=False)
+    created_at = Column(DateTime(timezone=True), server_default=func.now())
+    updated_at = Column(DateTime(timezone=True), server_default=func.now(), onupdate=func.now())
+
+    user = relationship("User", back_populates="bill_notes")
+    bill = relationship("Bill", back_populates="notes")
+
+    __table_args__ = (
+        UniqueConstraint("user_id", "bill_id", name="uq_bill_notes_user_bill"),
+        Index("ix_bill_notes_user_id", "user_id"),
+        Index("ix_bill_notes_bill_id", "bill_id"),
+    )

backend/app/models/user.py

@@ -19,3 +19,4 @@ class User(Base):
 
     follows = relationship("Follow", back_populates="user", cascade="all, delete-orphan")
     notification_events = relationship("NotificationEvent", back_populates="user", cascade="all, delete-orphan")
+    bill_notes = relationship("BillNote", back_populates="user", cascade="all, delete-orphan")

backend/app/schemas/schemas.py

@@ -4,6 +4,26 @@ from typing import Any, Generic, Optional, TypeVar
 from pydantic import BaseModel
 
 
+# ── Notifications ──────────────────────────────────────────────────────────────
+
+# ── Bill Notes ────────────────────────────────────────────────────────────────
+
+class BillNoteSchema(BaseModel):
+    id: int
+    bill_id: str
+    content: str
+    pinned: bool
+    created_at: datetime
+    updated_at: datetime
+
+    model_config = {"from_attributes": True}
+
+
+class BillNoteUpsert(BaseModel):
+    content: str
+    pinned: bool = False
+
+
 # ── Notifications ──────────────────────────────────────────────────────────────
 
 class NotificationSettingsResponse(BaseModel):