POST /v1/notes requires undocumented 'lastMutationAt' field

[sharabash]

Summary

Same issue as #73 but for the notes endpoint. POST /v1/notes returns 422 Unprocessable Entity with "lastMutationAt" is required, but this field is not documented.

Observed behavior

Request:

{
  "body": "The youth of the Cave chose faith over comfort...",
  "saveToQR": false,
  "ranges": ["18:10-18:10"]
}

Response: 422 Unprocessable Entity

{
  "details": {
    "success": false,
    "error": {
      "code": "ValidationError",
      "message": "\"lastMutationAt\" is required",
      "details": {"lastMutationAt": "MISSING"}
    }
  },
  "message": "\"lastMutationAt\" is required",
  "type": "unprocessable_entity",
  "success": false
}

Notes

• The field was also sent in the JSON body — the API still reports it as MISSING, suggesting the schema's additionalProperties: false strips it before business logic validation runs.
• This likely affects all write endpoints (bookmarks, notes, reading sessions).
• Related: POST /v1/bookmarks requires undocumented 'lastMutationAt' field #73

Tested against: https://apis-prelive.quran.foundation/auth/v1/notes

[sharabash]

Update: lastMutationAt affects ALL note write endpoints

E2E testing confirms this affects every note mutation endpoint, not just POST /v1/notes:

Method	Endpoint	Operation
POST	/v1/notes	Create note
PATCH	/v1/notes/:id	Update note
DELETE	/v1/notes/:id	Delete note
POST	/v1/notes/:id/publish	Publish note

All return 422: "lastMutationAt" is required. The read endpoints (GET /v1/notes, GET /v1/notes/:id, GET /v1/notes/by-verse, GET /v1/notes/ayahs-range, GET /v1/notes/by-entity, GET /v1/notes/count-in-range) work fine.

Tested against: https://apis-prelive.quran.foundation/auth/v1/notes