Fix cross-note block mutation vulnerability by requiring noteId

[egeozcan]

This PR ensures that noteId is explicitly required for any block mutation requests (such as updating content, updating state, or deleting a block). Previously, omitting noteId in requests would skip the authorization checks, allowing cross-note modifications. The frontend API client and the test suite have been updated to include noteId consistently.

---

PR created automatically by Jules for task 16124615787883183077 started by @egeozcan

[google-labs-jules]

👋 Jules, reporting for duty! I'm here to lend a hand with this pull request.

When you start a review, I'll add a 👀 emoji to each comment to let you know I've read it. I'll focus on feedback directed at me and will do my best to stay out of conversations between you and other bots or reviewers to keep the noise down.

I'll push a commit with your requested changes shortly after. Please note there might be a delay between these steps, but rest assured I'm on the job!

For more direct control, you can switch me to Reactive Mode. When this mode is on, I will only act on comments where you specifically mention me with @jules. You can find this option in the Pull Request section of your global Jules UI settings. You can always switch back!

New to Jules? Learn more at jules.google/docs.

---

For security, I will only act on instructions from the user who triggered this task.

[egeozcan]

Review (automated): the handler change is correct (noteId required, ownership checked before mutate on PUT/PATCH/DELETE/POST-delete), but it left callers broken or stale. Fixed in 6927aca: mr CLI update/update-state/delete now look up the block and send its noteId (previously would 400); e2e API client helpers likewise; openapi.yaml marks noteId required on 4 operations; docs-site API/concepts/custom-block-types docs and the retake-screenshots skill updated (docs said noteId was optional); public/dist/main.js was not rebuilt after the blockEditor.js change, now rebuilt. Added tests pinning the missing-noteId 400 on all four routes (red on master handler, green now) and wrong-noteId on state/POST-delete. Ran: full go test (json1 fts5), Postgres block/scoped api_tests, E2E blocks+plugin-blocks, CLI project (352), cli-doctest. Note: remaining behaviour change is breaking for external API clients that omitted noteId, intended per the PR.

[google-labs-jules]

Review (automated): the handler change is correct (noteId required, ownership checked before mutate on PUT/PATCH/DELETE/POST-delete), but it left callers broken or stale. Fixed in 6927aca: mr CLI update/update-state/delete now look up the block and send its noteId (previously would 400); e2e API client helpers likewise; openapi.yaml marks noteId required on 4 operations; docs-site API/concepts/custom-block-types docs and the retake-screenshots skill updated (docs said noteId was optional); public/dist/main.js was not rebuilt after the blockEditor.js change, now rebuilt. Added tests pinning the missing-noteId 400 on all four routes (red on master handler, green now) and wrong-noteId on state/POST-delete. Ran: full go test (json1 fts5), Postgres block/scoped api_tests, E2E blocks+plugin-blocks, CLI project (352), cli-doctest. Note: remaining behaviour change is breaking for external API clients that omitted noteId, intended per the PR.

Acknowledged. Thanks for fixing the callers, CLI, openapi.yaml, and rebuilding the frontend! The intention is indeed to break external clients that omit noteId to properly enforce authorization.