Add /new create flow and two-intent delete

[unforced]

Summary

• /new route: path (required), optional one-line metadata.summary, shared tag chip editor, CodeMirror content editor + live preview. On create → toast + navigate to /notes/<new-id> (read view, not editor).
• Delete button on NoteView and NoteEditor opens a two-intent modal: must type the note's path exactly before the destructive button enables. Success → toast + navigate /notes, with the deleted note removed from cache and lists invalidated.
• Minimal useToastStore + <Toaster /> portal for create/delete feedback (no library).
• TagEditor extracted so /new and /edit share the chip input.
• VaultClient.createNote / deleteNote and matching mutation hooks. 401 surfaces as VaultAuthError on both paths.
• Home and /notes empty-state "Create one" now links to /new.

Scope calls

• Duplicate-path: vault returns 500 with "Internal server error" (UNIQUE violation surfaces as a generic error), not a typed conflict — /new shows the server message with a hint "if the path is taken, try a different one." Cleaner duplicate handling is a vault-side change.
• No undo-delete in v1, as scoped. Cache is invalidated after DELETE.
• Delete uses the type-the-path gate rather than a second "Really delete" button — higher friction for an irreversible action.
• Toaster uses native <output aria-live="polite"> and the confirm modal uses native <dialog open> to satisfy a11y lints; keeping the existing backdrop-click-to-close/Escape handlers.

Test plan

• bun run typecheck — clean
• bun run lint — clean
• bun run test — 88 pass (14 files)
• bun run build — clean
• New tests cover: createNote/deleteNote client paths incl. 401, /new validation + happy POST + duplicate-path error preservation, delete modal gate (single click doesn't delete; Enter without match doesn't delete; happy DELETE + navigate + toast).

🤖 Generated with Claude Code