fix(annotations): note LWW re-save 500'd — UserID missing from the sync update params

Pin-first batch for H3: freeze web annotation CRUD response shapes
(create 201 / update 200 / delete 204; full sqlc row models) before
the stack consolidation touches anything.

The new pins immediately caught a live server bug the 28 unit tests
could never see (annotations_test.go is pure-unit: keys and compare
logic, no DB): applyNoteLWW built UpdateMediaNoteForSyncParams without
UserID, so the query's WHERE id=$1 AND user_id=$13 compared against
zero — every dedup-hit note re-save (same content+position) returned
500 "update note: no rows in result set" and the update never landed.
The bookmark twin passes UserID and works; the note stack is the clone
that dropped the field.

Fix: pass UserID in the params (one line). Pins go green and become
the regression net; changelog records the new surfaces.

docs/contract_pins.md

@@ -61,3 +61,16 @@ cover_image_path, has_conflict, format_group, badge`.
   reader.ts:3113-3143 and audio.ts:518-520); keys the web never sent
   (viewport_x/y, panel_number) merely become honor-able. All other pins
   unchanged.
+- **H3-prep (web annotation CRUD freeze)** — NEW pinned surfaces, captured
+  pre-refactor per the pin-first doctrine: `POST/PUT/DELETE
+  /api/media-items/:id/{notes,highlights,bookmarks}` — create 201 / update
+  200 / delete 204, response bodies are the full sqlc row models
+  (MediaNotes 19 keys, MediaBookmarks 20 keys, MediaHighlights 27 keys —
+  listed in contract_pins_test.go). No keys removed; nothing was pinned
+  here before. Capturing these immediately caught a LIVE server bug:
+  `applyNoteLWW` omitted `UserID` from its
+  `UpdateMediaNoteForSync` params, so every dedup-hit note re-save
+  (same content+position ⇒ same key) returned 500
+  ("update note: no rows in result set") — the LWW update could never
+  land. Fixed in the same commit (server-side fix, freely allowed);
+  the pins are its regression net.