fix(notes): add company_notes.updated_at, drop createdAt substitution

company_notes was missing updated_at — every other notes table has it,
and notes.service.ts substituted created_at into the response shape so
callers wouldn't notice. Add the column (defaulted + backfilled to
created_at for existing rows), wire the update path to set it on
edit, and drop the substitution from the read + edit handlers.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

src/lib/db/migrations/0048_company_notes_updated_at.sql

@@ -0,0 +1,7 @@
+-- Add updated_at to company_notes so the notes service can return a real
+-- modified timestamp (was substituting created_at). Backfill updated_at
+-- to created_at for existing rows so they read as "never modified".
+ALTER TABLE "company_notes"
+  ADD COLUMN IF NOT EXISTS "updated_at" timestamp with time zone NOT NULL DEFAULT now();
+
+UPDATE "company_notes" SET "updated_at" = "created_at";

src/lib/db/schema/companies.ts

@@ -123,6 +123,7 @@ export const companyNotes = pgTable(
     mentions: text('mentions').array(),
     isLocked: boolean('is_locked').notNull().default(false),
     createdAt: timestamp('created_at', { withTimezone: true }).notNull().defaultNow(),
+    updatedAt: timestamp('updated_at', { withTimezone: true }).notNull().defaultNow(),
   },
   (table) => [index('idx_compn_company').on(table.companyId)],
 );

src/lib/services/notes.service.ts

@@ -305,7 +305,7 @@ export async function listForEntity(portId: string, entityType: EntityType, enti
         mentions: companyNotes.mentions,
         isLocked: companyNotes.isLocked,
         createdAt: companyNotes.createdAt,
-        updatedAt: companyNotes.createdAt,
+        updatedAt: companyNotes.updatedAt,
         authorName: userProfiles.displayName,
       })
       .from(companyNotes)
@@ -551,7 +551,7 @@ export async function update(
     }
     const [updated] = await db
       .update(companyNotes)
-      .set({ content: data.content })
+      .set({ content: data.content, updatedAt: new Date() })
       .where(eq(companyNotes.id, noteId))
       .returning();
     if (!updated) throw new NotFoundError('Note');
@@ -563,7 +563,6 @@ export async function update(
     return {
       ...updated,
       authorName: profile[0]?.displayName ?? null,
-      updatedAt: updated.createdAt,
     };
   }
   if (entityType === 'clients') {