Confirm note fields and serve team images

[jserv]

Several tools reported or implied that HackMD did something nobody had shown it does. The worst case: hackmd_create_note forwarded comment_permission and suggest_edit_permission, which HackMD drops on create, and never checked read_permission, so a dropped owner-only permission left a note more open than asked with no warning. Create and update now refuse the two unsettable permissions. Create compares what it sent against the note it returns and lists anything that never shows in unconfirmed_fields; that is never an error, because the note exists and an error would invite a duplicate create.

Image upload now serves team notes through the same /notes/{id}/images route, which accepted a team note when measured on 2026-10-06. The same sweep closed other checks that could pass without proof: a read without folderPaths confirming a move to the root, child_order confirming IDs that are not children of the folder, and folder read-backs failing over null versus "" or letter case. Push without note_ref refuses only a team_path that contradicts the sync record, so callers passing the note's own team keep working. Tool descriptions and docs now claim only what was measured.

Verified with cargo test --all-targets --all-features (286 unit, 11 stdio; the live suites are ignored by design) and cargo clippy --all-targets --all-features -- -D warnings, both clean. Codex and Claude reviewers checked each round.

Not verified: the claims the destructive live suite exists to settle. It now prints or asserts the default permissions a create gets, a team create's owner permissions, a 7 MiB image upload, the plain-route team upload, and that an anonymous fetch of an owner-only note's image is refused. It has not been run for this change; it needs the dedicated throwaway account.

---

Summary by cubic

Create now confirms what it sent. comment_permission and suggest_edit_permission are refused on both create and update, because the API drops or rejects them; a dropped read_permission could leave a note more open than asked, so create polls until the sent fields show and lists anything that never does in unconfirmed_fields (tags, description, permalink, and the two permissions only), never as an error. Image upload serves team notes through the plain /notes/{id}/images route, which was measured to accept them. Checks that could pass without proof are closed: a read omitting folderPaths no longer confirms a move to the root, child_order refuses IDs that are not direct children of an existing folder, folder read-backs tolerate null/"" and case differences, and push without note_ref refuses a team_path contradicting the sync record. Tool descriptions and docs now claim only what was measured; the 5 MiB image limit and other unmeasured behaviors are stated as unmeasured.

• Live destructive suite gains probes for the default permissions, team uploads, 7 MiB uploads (with a valid padded PNG), and anonymous image access.
• Requires a workspace root for uploads, since an image on a guest-readable note is public.

^{Written for commit b92285d. Summary will update on new commits.}