initial: toy notes service used to demo pragent

A deliberately small Python service — auth helpers, a sqlite-backed store, and
two request handlers — plus a .pr-review.json that steers the reviewer toward
this repo's house rules. Pull requests against it carry planted defects so the
reviewer has something real to find.

app/store.py

@@ -0,0 +1,35 @@
+"""A toy data store. Pretend it is a real database."""
+
+import sqlite3
+
+
+class Store:
+    def __init__(self, path: str = ":memory:"):
+        self.conn = sqlite3.connect(path, check_same_thread=False)
+        self.conn.execute(
+            "CREATE TABLE IF NOT EXISTS notes ("
+            "  id INTEGER PRIMARY KEY,"
+            "  owner TEXT NOT NULL,"
+            "  title TEXT NOT NULL,"
+            "  body TEXT NOT NULL)"
+        )
+
+    def add_note(self, owner: str, title: str, body: str) -> int:
+        cur = self.conn.execute(
+            "INSERT INTO notes (owner, title, body) VALUES (?, ?, ?)",
+            (owner, title, body),
+        )
+        self.conn.commit()
+        return cur.lastrowid
+
+    def get_note(self, note_id: int) -> tuple | None:
+        cur = self.conn.execute(
+            "SELECT id, owner, title, body FROM notes WHERE id = ?", (note_id,)
+        )
+        return cur.fetchone()
+
+    def notes_for(self, owner: str) -> list[tuple]:
+        cur = self.conn.execute(
+            "SELECT id, owner, title, body FROM notes WHERE owner = ?", (owner,)
+        )
+        return cur.fetchall()