initial: toy notes service used to demo pragent

A deliberately small Python service — auth helpers, a sqlite-backed store, and
two request handlers — plus a .pr-review.json that steers the reviewer toward
this repo's house rules. Pull requests against it carry planted defects so the
reviewer has something real to find.

app/api.py

@@ -0,0 +1,32 @@
+"""Request handlers. `request` is a dict of {path, query, headers}."""
+
+from app import auth
+from app.store import Store
+
+STORE = Store()
+
+
+def _current_user(request: dict) -> str | None:
+    token = request.get("headers", {}).get("Authorization", "").removeprefix("Bearer ")
+    if not token:
+        return None
+    return auth.user_for_token(token)
+
+
+def list_notes(request: dict) -> dict:
+    user = _current_user(request)
+    if user is None:
+        return {"status": 401, "body": "unauthenticated"}
+    return {"status": 200, "body": STORE.notes_for(user)}
+
+
+def get_note(request: dict) -> dict:
+    user = _current_user(request)
+    if user is None:
+        return {"status": 401, "body": "unauthenticated"}
+    note = STORE.get_note(int(request["query"]["id"]))
+    if note is None:
+        return {"status": 404, "body": "not found"}
+    if note[1] != user:
+        return {"status": 403, "body": "forbidden"}
+    return {"status": 200, "body": note}