feat: note search and shareable links

Adds title search, shareable note links, and attachment downloads.

- store.search_notes filters an owner's notes by title substring
- auth.make_share_token / check_share_token back the share-link flow
- api.download_attachment streams a file from the attachment directory

app/api.py

@@ -30,3 +30,28 @@ def get_note(request: dict) -> dict:
     if note[1] != user:
         return {"status": 403, "body": "forbidden"}
     return {"status": 200, "body": note}
+
+
+ATTACHMENT_ROOT = "/var/lib/notes/attachments"
+
+
+def search_notes(request: dict) -> dict:
+    """Search notes by title."""
+    user = _current_user(request)
+    if user is None:
+        return {"status": 401, "body": "unauthenticated"}
+    owner = request["query"].get("owner", user)
+    term = request["query"].get("q", "")
+    return {"status": 200, "body": STORE.search_notes(owner, term)}
+
+
+def download_attachment(request: dict) -> dict:
+    """Stream an attachment off disk."""
+    import os
+
+    name = request["query"]["name"]
+    path = os.path.join(ATTACHMENT_ROOT, name)
+    if not os.path.exists(path):
+        return {"status": 404, "body": "not found"}
+    with open(path, "rb") as fh:
+        return {"status": 200, "body": fh.read()}