fix(annotations): bookmark and note PUTs land through the sync service (LWW by id)

H3 census bugs #2 and #3: both web PUTs used plain queries that
bypassed the sync-aware layer entirely — no LWW, no source bookkeeping,
and locator fields the client couldn't even send. The highlight PUT was
the only one already routed (via HighlightID); the other two now mirror
it:

- SaveBookmarkRequest gains BookmarkID, SaveNoteRequest gains NoteID:
  id-targeted resolution reads the exact row, verifies ownership,
  LWWs under its stored dedup key, and resurrects tombstones when the
  edit is newer (same doctrine and comment structure as the highlight
  path).
- Fields the PUT omits are coalesced from the stored row before the
  full-column sync update — the legacy web PUT sends only
  title/notes/position, and zeroing cfi/percentage/page on every edit
  would have been data loss. Verified both directions by
  TestH3_BookmarkPUTPreservesLocators (omitted survives, explicit
  lands).
- The bookmark PUT's wire DTO gains the create endpoint's locator keys
  as optional fields (documented additive request keys in
  contract_pins.md); the note PUT keeps its content+position wire.

UpdateMediaBookmark/UpdateMediaNote plain queries are now uncalled
(the generated queries stay until the H4 query sweep).

docs/contract_pins.md

@@ -74,3 +74,16 @@ cover_image_path, has_conflict, format_group, badge`.
   ("update note: no rows in result set") — the LWW update could never
   land. Fixed in the same commit (server-side fix, freely allowed);
   the pins are its regression net.
+- **H3 (PUT fixes routed through the sync service)** — `PUT
+  /api/media-items/:id/bookmarks/:bookmarkId` now parses ADDITIONAL
+  optional request keys mirroring its create sibling:
+  `cfi_position, page_number, chapter_number, percentage,
+  chapter_reference` (all zero-value-preserving: omitted keys coalesce
+  with the stored row inside the service, so legacy clients that send
+  only title/notes/position keep every stored locator — verified by
+  TestH3_BookmarkPUTPreservesLocators). The PUT lands as an id-targeted
+  LWW edit under the row's stored dedup key (BookmarkID/NoteID mirror
+  SaveHighlightRequest.HighlightID), so `last_modified_source` /
+  `last_modified_at` are now maintained. Note PUT unchanged on the wire
+  (content+position) but routed through the service the same way.
+  Response shapes unchanged (same row models — pins green).