Stage 28 — Lesson Notes API

Endpoint:
  GET /api/v1/lesson-notes/

Bearer-token protected, read-only lesson-note metadata.

Scopes:
- Pupil/student: only lesson notes for the pupil's own class.
- Parent: only lesson notes for classes containing the parent's active children.
- Admin/approved staff: may query lesson notes and optionally filter by class.

Filters:
- class_id
- subject
- session
- term
- week
- limit (default 20, maximum 100)
- offset

The lesson_note content blob is intentionally not returned. File/remark metadata is returned.
No database schema changes are made.
