fix(api): normaliza categories/tags nil para [] no JSON

Slices Go nil viram 'null' no JSON, o que quebra clientes com tipos
não-nuláveis com default (kotlinx.serialization rejeita null explícito).
newNoteView/normalizeNote garante [] em list/get/create/update/restore.
Motivado por teste real do cliente Android (duplicava creates ao falhar
o decode da resposta 201).

internal/api/notes.go

@@ -47,6 +47,22 @@ type noteView struct {
 	Content string `json:"content"`
 }
 
+// normalizeNote garante que slices nil viram [] no JSON (null quebra
+// clientes com tipos não-nuláveis, ex. kotlinx.serialization).
+func normalizeNote(n *store.Note) {
+	if n.Categories == nil {
+		n.Categories = []string{}
+	}
+	if n.Tags == nil {
+		n.Tags = []string{}
+	}
+}
+
+func newNoteView(n *store.Note, content string) noteView {
+	normalizeNote(n)
+	return noteView{n, content}
+}
+
 func (s *Server) handleListNotes(w http.ResponseWriter, r *http.Request) {
 	q := r.URL.Query()
 	recursive := q.Get("recursive") != "0"
@@ -63,6 +79,9 @@ func (s *Server) handleListNotes(w http.ResponseWriter, r *http.Request) {
 	if notes == nil {
 		notes = []*store.Note{}
 	}
+	for _, n := range notes {
+		normalizeNote(n)
+	}
 	writeJSON(w, http.StatusOK, notes)
 }
 
@@ -79,7 +98,7 @@ func (s *Server) handleCreateNote(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	s.publishSaved(n, author, in.Session, false)
-	writeJSON(w, http.StatusCreated, noteView{n, content})
+	writeJSON(w, http.StatusCreated, newNoteView(n, content))
 }
 
 func (s *Server) handleGetNote(w http.ResponseWriter, r *http.Request) {
@@ -88,7 +107,7 @@ func (s *Server) handleGetNote(w http.ResponseWriter, r *http.Request) {
 		mapStoreError(w, err)
 		return
 	}
-	writeJSON(w, http.StatusOK, noteView{n, content})
+	writeJSON(w, http.StatusOK, newNoteView(n, content))
 }
 
 func (s *Server) handleUpdateNote(w http.ResponseWriter, r *http.Request) {
@@ -113,7 +132,7 @@ func (s *Server) handleUpdateNote(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	s.publishSaved(n, author, in.Session, false)
-	writeJSON(w, http.StatusOK, noteView{n, content})
+	writeJSON(w, http.StatusOK, newNoteView(n, content))
 }
 
 func (s *Server) handleDeleteNote(w http.ResponseWriter, r *http.Request) {

internal/api/revisions.go

@@ -103,7 +103,7 @@ func (s *Server) handleRestore(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	s.publishSaved(n, in.Author, in.Session, false)
-	writeJSON(w, http.StatusOK, noteView{n, content})
+	writeJSON(w, http.StatusOK, newNoteView(n, content))
 }
 
 func short(hash string) string {