initial: toy notes service used to demo pragent

A deliberately small Python service — auth helpers, a sqlite-backed store, and
two request handlers — plus a .pr-review.json that steers the reviewer toward
this repo's house rules. Pull requests against it carry planted defects so the
reviewer has something real to find.

app/auth.py

@@ -0,0 +1,26 @@
+"""Token and session helpers."""
+
+import hmac
+import secrets
+
+_SESSIONS: dict[str, str] = {}
+
+
+def new_token() -> str:
+    """Generate an opaque session token."""
+    return secrets.token_urlsafe(32)
+
+
+def verify_token(supplied: str, expected: str) -> bool:
+    """Constant-time token comparison."""
+    return hmac.compare_digest(supplied, expected)
+
+
+def login(user_id: str) -> str:
+    token = new_token()
+    _SESSIONS[token] = user_id
+    return token
+
+
+def user_for_token(token: str) -> str | None:
+    return _SESSIONS.get(token)