feat: aplicação inicial — gerenciador de notas web estilo Mousepad

- Backend Go: API REST, auth por token (Bearer + cookie HttpOnly), storage em disco
  com revisões content-addressed (estilo Git: hash, autor, data, diff, restauração)
- Editor txt/md/html com preview, tags #tag, categorias, painel de histórico
- Preferências: números de linha, marcador de coluna (padrão 80), quebra de linha,
  fonte/tamanho, 4 temas e colorização de sintaxe (overlay no textarea)
- Frontend vanilla embutido via go:embed; Dockerfile multi-stage + docker-compose

internal/api/notes.go

@@ -0,0 +1,165 @@
+package api
+
+import (
+	"io/fs"
+	"net/http"
+	"strings"
+
+	"github.com/lgcosta/notas-online/internal/store"
+)
+
+// serveIndex entrega o shell da aplicação.
+func (s *Server) serveIndex(w http.ResponseWriter, r *http.Request) {
+	data, err := fs.ReadFile(s.webFS, "index.html")
+	if err != nil {
+		http.Error(w, "frontend ausente no binário", http.StatusInternalServerError)
+		return
+	}
+	w.Header().Set("Content-Type", "text/html; charset=utf-8")
+	w.Header().Set("Cache-Control", "no-cache")
+	_, _ = w.Write(data)
+}
+
+// noteInput é o corpo aceito por POST/PUT de notas.
+type noteInput struct {
+	Title    string `json:"title"`
+	Format   string `json:"format"`
+	Category string `json:"category"`
+	Content  string `json:"content"`
+	Author   string `json:"author"`
+	Message  string `json:"message"`
+}
+
+func (in noteInput) fields() (string, string, string, string, string, string) {
+	f := in.Format
+	if f == "" {
+		f = store.FormatTxt
+	}
+	return in.Title, f, in.Category, in.Content, in.Author, in.Message
+}
+
+// noteView é a representação completa (meta + conteúdo) de uma nota.
+type noteView struct {
+	*store.Note
+	Content string `json:"content"`
+}
+
+func (s *Server) handleListNotes(w http.ResponseWriter, r *http.Request) {
+	q := r.URL.Query()
+	notes, err := s.st.List(store.Filter{
+		Category: q.Get("category"),
+		Tag:      q.Get("tag"),
+		Query:    q.Get("q"),
+	})
+	if err != nil {
+		mapStoreError(w, err)
+		return
+	}
+	if notes == nil {
+		notes = []*store.Note{}
+	}
+	writeJSON(w, http.StatusOK, notes)
+}
+
+func (s *Server) handleCreateNote(w http.ResponseWriter, r *http.Request) {
+	var in noteInput
+	if err := decodeJSON(r, &in, maxBody); err != nil {
+		writeError(w, http.StatusBadRequest, "corpo JSON inválido")
+		return
+	}
+	title, format, category, content, author, message := in.fields()
+	n, err := s.st.Create(title, format, category, content, author, message)
+	if err != nil {
+		mapStoreError(w, err)
+		return
+	}
+	writeJSON(w, http.StatusCreated, noteView{n, content})
+}
+
+func (s *Server) handleGetNote(w http.ResponseWriter, r *http.Request) {
+	content, n, err := s.st.Content(r.PathValue("id"))
+	if err != nil {
+		mapStoreError(w, err)
+		return
+	}
+	writeJSON(w, http.StatusOK, noteView{n, content})
+}
+
+func (s *Server) handleUpdateNote(w http.ResponseWriter, r *http.Request) {
+	var in noteInput
+	if err := decodeJSON(r, &in, maxBody); err != nil {
+		writeError(w, http.StatusBadRequest, "corpo JSON inválido")
+		return
+	}
+	title, format, category, content, author, message := in.fields()
+	n, err := s.st.Update(r.PathValue("id"), title, format, category, content, author, message)
+	if err != nil {
+		mapStoreError(w, err)
+		return
+	}
+	writeJSON(w, http.StatusOK, noteView{n, content})
+}
+
+func (s *Server) handleDeleteNote(w http.ResponseWriter, r *http.Request) {
+	if err := s.st.Delete(r.PathValue("id")); err != nil {
+		mapStoreError(w, err)
+		return
+	}
+	w.WriteHeader(http.StatusNoContent)
+}
+
+// handleRaw baixa a nota como arquivo (Content-Disposition attachment).
+func (s *Server) handleRaw(w http.ResponseWriter, r *http.Request) {
+	content, n, err := s.st.Content(r.PathValue("id"))
+	if err != nil {
+		mapStoreError(w, err)
+		return
+	}
+	ctype := "text/plain; charset=utf-8"
+	switch n.Format {
+	case store.FormatMD:
+		ctype = "text/markdown; charset=utf-8"
+	case store.FormatHTML:
+		ctype = "text/html; charset=utf-8"
+	}
+	w.Header().Set("Content-Type", ctype)
+	w.Header().Set("Content-Disposition",
+		`attachment; filename="`+sanitizeFilename(n.Filename())+`"`)
+	w.Header().Set("Cache-Control", "no-store")
+	_, _ = w.Write([]byte(content))
+}
+
+// sanitizeFilename elimina caracteres que quebrariam o header.
+func sanitizeFilename(name string) string {
+	return strings.Map(func(r rune) rune {
+		switch r {
+		case '"', '\\', '\n', '\r', '/':
+			return '_'
+		}
+		return r
+	}, name)
+}
+
+func (s *Server) handleTags(w http.ResponseWriter, r *http.Request) {
+	tags, err := s.st.Tags()
+	if err != nil {
+		mapStoreError(w, err)
+		return
+	}
+	if tags == nil {
+		tags = []store.TagCount{}
+	}
+	writeJSON(w, http.StatusOK, tags)
+}
+
+func (s *Server) handleCategories(w http.ResponseWriter, r *http.Request) {
+	cats, err := s.st.Categories()
+	if err != nil {
+		mapStoreError(w, err)
+		return
+	}
+	if cats == nil {
+		cats = []store.CatCount{}
+	}
+	writeJSON(w, http.StatusOK, cats)
+}