iOS Shortcut note capture

This adds a minimal, token-protected endpoint for quick note capture from iOS Shortcuts. Tokens are generated per-user in the web UI and shown only once.

Setup (UI path)

Set PUBLIC_BASE_URL in /opt/lucille/env/backend.env (for example http://159.65.126.83:8000).
Sign in to the web app and go to /integrations.
In "iOS Shortcut Token", click "Generate token" (or "Regenerate token").
Copy the token and the setup blocks shown in the modal. Tokens are shown only once.
In iOS Shortcuts, set the request URL exactly to the shown endpoint URL, add the header X-Note-Token, set JSON body, and run a test note.

If you lose the token, regenerate it.

Setup (curl path)

Set PUBLIC_BASE_URL in /opt/lucille/env/backend.env.
Generate a token via API:

curl -s -X POST \
  -H "Authorization: Bearer <SUPABASE_JWT>" \
  https://<your-host>/me/ingest-tokens/note/regenerate

Use the returned endpoint_url, headers, and JSON body in your Shortcut.

Backend configuration:

Set INGEST_TOKEN_PEPPER in the backend env to enable token hashing.
Set PUBLIC_BASE_URL so the API can return copy/paste-ready setup values.

Shortcut outline

Ask for Input
- Type: Text
- Prompt: "Quick note"
(Optional) Choose from Menu
- Mood choices (e.g. calm, focused, tired)
- Energy choices (1-5)
- Tags (comma-separated or multiple menus)
Get Contents of URL
- URL: <endpoint_url> from the UI or regenerate response
- Method: POST
- Headers:
  - Content-Type: application/json
  - X-Note-Token: <your token>
- Request Body: JSON

Example JSON body

{
  "text": "Met with Jill about the Q2 plan. Feeling good.",
  "tags": ["planning", "work"],
  "mood": "calm",
  "energy": 4,
  "occurred_at": "2026-01-27T10:14:00-05:00",
  "source": "ios_shortcut"
}

Notes:

text is required (1..4000).
tags is optional (max 10).
energy is optional (1..5).
occurred_at is optional; server uses current time if omitted.
source defaults to ios_shortcut.

Legacy fallback (optional)

If you still use a global token, configure NOTE_INGEST_TOKEN and NOTE_DEFAULT_USER_ID. This is intended as a temporary fallback; prefer per-user tokens.