fix(annotations): bookmark and note PUTs land through the sync service (LWW by id)

H3 census bugs #2 and #3: both web PUTs used plain queries that
bypassed the sync-aware layer entirely — no LWW, no source bookkeeping,
and locator fields the client couldn't even send. The highlight PUT was
the only one already routed (via HighlightID); the other two now mirror
it:

- SaveBookmarkRequest gains BookmarkID, SaveNoteRequest gains NoteID:
  id-targeted resolution reads the exact row, verifies ownership,
  LWWs under its stored dedup key, and resurrects tombstones when the
  edit is newer (same doctrine and comment structure as the highlight
  path).
- Fields the PUT omits are coalesced from the stored row before the
  full-column sync update — the legacy web PUT sends only
  title/notes/position, and zeroing cfi/percentage/page on every edit
  would have been data loss. Verified both directions by
  TestH3_BookmarkPUTPreservesLocators (omitted survives, explicit
  lands).
- The bookmark PUT's wire DTO gains the create endpoint's locator keys
  as optional fields (documented additive request keys in
  contract_pins.md); the note PUT keeps its content+position wire.

UpdateMediaBookmark/UpdateMediaNote plain queries are now uncalled
(the generated queries stay until the H4 query sweep).

cmd/server/tests/contract_pins_test.go

@@ -1218,3 +1218,91 @@ func TestContractPin_AnnotationCRUDBookmark(t *testing.T) {
 		},
 		_WEBBookmarkRowKeys)
 }
+
+// TestH3_BookmarkPUTPreservesLocators locks the H3 PUT routing: the web
+// bookmark PUT lands through the sync service as an id-targeted LWW edit.
+// Fields the PUT omits must be COALESCED with the stored row (the old
+// plain query never touched them; a naive full-column sync write would
+// have zeroed them), fields it sends must land, and the row's
+// source/modified_at bookkeeping must update — the plain query bypassed
+// it entirely.
+func TestH3_BookmarkPUTPreservesLocators(t *testing.T) {
+	if testing.Short() {
+		t.Skip("Skipping integration test in short mode")
+	}
+	setup := setupTestServer(t)
+	fx := createContractFixture(t, setup)
+	url := annotationURL(setup.Server.URL, fx.itemID, "bookmarks", "")
+
+	create := doReq(t, "POST", url, map[string]interface{}{
+		"title":             "H3 bookmark",
+		"position":          "p1",
+		"cfi_position":      "epubcfi(/6/4/2:30)",
+		"page_number":       12,
+		"chapter_number":    3,
+		"percentage":        0.25,
+		"chapter_reference": 4,
+	}, setup.RegularToken)
+	defer create.Body.Close()
+	require.Equal(t, http.StatusCreated, create.StatusCode)
+	created := decodeJSON(t, create)
+	id, _ := created["id"].(string)
+	require.NotEmpty(t, id)
+
+	// PUT carrying ONLY the legacy fields: locators must survive.
+	put := doReq(t, "PUT", annotationURL(setup.Server.URL, fx.itemID, "bookmarks", id), map[string]interface{}{
+		"title": "H3 bookmark renamed",
+		"notes": "edited",
+	}, setup.RegularToken)
+	defer put.Body.Close()
+	raw, _ := io.ReadAll(put.Body)
+	require.Equal(t, http.StatusOK, put.StatusCode, "body: %s", raw)
+	var row map[string]interface{}
+	require.NoError(t, json.Unmarshal(raw, &row))
+	require.Equal(t, "H3 bookmark renamed", getStringField(t, row, "title"))
+	require.Equal(t, "epubcfi(/6/4/2:30)", getStringField(t, row, "cfi_position"),
+		"an omitted locator must be coalesced, not zeroed")
+	require.Equal(t, 0.25, getFloatField(t, row, "percentage_location"),
+		"an omitted locator must be coalesced, not zeroed")
+	require.Equal(t, float64(12), getFloatField(t, row, "page_number"))
+	require.Equal(t, "web", getStringField(t, row, "last_modified_source"),
+		"the sync-routed PUT must maintain source bookkeeping")
+
+	// PUT carrying a locator explicitly: it lands.
+	put2 := doReq(t, "PUT", annotationURL(setup.Server.URL, fx.itemID, "bookmarks", id), map[string]interface{}{
+		"title":        "H3 bookmark renamed",
+		"notes":        "edited",
+		"percentage":   0.5,
+		"cfi_position": "epubcfi(/6/4/2:44)",
+	}, setup.RegularToken)
+	defer put2.Body.Close()
+	raw2, _ := io.ReadAll(put2.Body)
+	require.Equal(t, http.StatusOK, put2.StatusCode, "body: %s", raw2)
+	var row2 map[string]interface{}
+	require.NoError(t, json.Unmarshal(raw2, &row2))
+	require.Equal(t, 0.5, getFloatField(t, row2, "percentage_location"))
+	require.Equal(t, "epubcfi(/6/4/2:44)", getStringField(t, row2, "cfi_position"))
+	// ...and the fields omitted THIS time coalesce again (page survived).
+	require.Equal(t, float64(12), getFloatField(t, row2, "page_number"))
+
+	// The note PUT carries its content edit through the service too.
+	noteURL := annotationURL(setup.Server.URL, fx.itemID, "notes", "")
+	noteCreate := doReq(t, "POST", noteURL, map[string]interface{}{
+		"content": "H3 note", "position": "p9",
+	}, setup.RegularToken)
+	defer noteCreate.Body.Close()
+	require.Equal(t, http.StatusCreated, noteCreate.StatusCode)
+	note := decodeJSON(t, noteCreate)
+	noteID, _ := note["id"].(string)
+	notePut := doReq(t, "PUT", annotationURL(setup.Server.URL, fx.itemID, "notes", noteID), map[string]interface{}{
+		"content": "H3 note edited", "position": "p9b",
+	}, setup.RegularToken)
+	defer notePut.Body.Close()
+	raw3, _ := io.ReadAll(notePut.Body)
+	require.Equal(t, http.StatusOK, notePut.StatusCode, "body: %s", raw3)
+	var noteRow map[string]interface{}
+	require.NoError(t, json.Unmarshal(raw3, &noteRow))
+	require.Equal(t, "H3 note edited", getStringField(t, noteRow, "content"))
+	require.Equal(t, "web", getStringField(t, noteRow, "last_modified_source"),
+		"the note PUT must maintain source bookkeeping via the sync service")
+}