initial: toy notes service used to demo pragent

A deliberately small Python service — auth helpers, a sqlite-backed store, and
two request handlers — plus a .pr-review.json that steers the reviewer toward
this repo's house rules. Pull requests against it carry planted defects so the
reviewer has something real to find.

README.md

@@ -0,0 +1,39 @@
+# pragent-demo
+
+A tiny, deliberately small service used to demonstrate
+[**pragent**](https://git.marcospaulo.dev.br/gitea_admin/pragent) — an AI pull-request
+reviewer for Gitea.
+
+## How the demo works
+
+1. Someone opens a pull request.
+2. A maintainer adds the **`AI-REVIEW`** label.
+3. A Gitea webhook notifies the pragent service, which checks the repo out at the
+   PR's head commit, reads the changed files *and the code around them*, runs the
+   repo's own linters, and posts a review — a summary plus **inline comments**
+   anchored to the exact lines, each with a suggested fix.
+4. Adding **`AI-USAGE`** as well appends a token/cost report to the review, so the
+   price of every review is visible rather than mysterious.
+
+No review fires without the label. Removing it stops re-reviews.
+
+> [!WARNING]
+> **This repository is a teaching fixture, not example code.**
+> Pull requests here contain *deliberately planted defects* — SQL injection, unsafe
+> path handling, weak comparisons — so the reviewer has something real to find.
+> Do not copy anything from this repo into a real project.
+
+## Steering the reviewer
+
+`.pr-review.json` on the **default branch** configures the review for this repo:
+focus areas, paths to ignore, and house rules. It is read from the base branch on
+purpose — otherwise a pull request could rewrite the rules it is judged by.
+
+## Layout
+
+```
+app/auth.py     token + session helpers
+app/store.py    a toy in-memory data store
+app/api.py      the request handlers
+tests/          what little coverage exists
+```