Add complaint notes and assignments

Add a staff note

• POST /api/v1/complaints/{complaintReference}/notes requires complaints:write.
• Send a UUID Idempotency-Key, positive expectedVersion, and note text from 1 through 2000 trimmed characters.
• Notes are staff-only audit context. They are not citizen-visible updates and must not promise resolution.
• Exact replay is safe; changed content under the same operation ID returns 409.

Change assignment

• Assignment uses the PATCH complaint route and requires both complaints:write and complaints:assign.
• Provide assignment with nullable teamId and userId to replace the current assignment deliberately.
• The database accepts only an account-owned team and an active organization member or direct account owner.
• A key with complaints:assign but no complaints:write cannot be created or used for assignment.

Keep evidence authority separate

Note example

curl -X POST "/api/v1/complaints/CMP-2026-0123456789ABCDEF/notes"   -H "X-API-Key: tus_live_your_key_here"   -H "Idempotency-Key: 00000000-0000-4000-8000-000000000002"   -H "Content-Type: application/json"   -d '{"expectedVersion":2,"note":"Reviewed by the ward office."}'