[Learner Notes][Privacy] Enforce owner-only access and encrypted note storage

[barry01-hash]

Context

Private learner annotations require server-derived ownership, encrypted storage, concurrency control, and deletion integration.

Scope

• Implement the missing behavior in the verified areas below with explicit validation and failure semantics.
• Preserve existing authorization, idempotency, and observability contracts.
• Document compatibility or migration behavior where persisted or on-chain data changes.
• Keep unrelated UI redesigns and protocol-economic changes out of scope.

Acceptance criteria

• The unsafe or inconsistent behavior is reproduced by a regression test before the fix.
• The implementation fails safely on invalid, stale, duplicated, concurrent, and partial-failure inputs relevant to this workflow.
• Unit, integration, or Soroban tests cover success and meaningful boundary and failure paths.
• Logs, metrics, and errors are actionable without exposing secrets or personal data.

Relevant areas

src/components/materials/LearnerNotes.jsx; src/app/api/materials/[id]/notes/route.js; src/lib/privacy/deletionExecutor.js

[Tobiloba0]

Hi maintainer, I would like to work on this issue.

[grantfox-oss]

🦊 GrantFox — @Tobiloba0 has been assigned to this issue as part of the Third Campaign campaign!

Next steps:

1. Open a Pull Request referencing this issue (e.g., Closes #166)
2. Your PR will be reviewed by the Eduvault-stellar maintainers

Good luck! Track your progress on GrantFox.