feat: gate full notes behind auth on single session endpoint

Made-with: Cursor

tests/api/regression-sessions.test.js

@@ -7,7 +7,7 @@ describe('GET /api/sessions (regression)', () => {
     cleanDb();
   });
 
-  test('GET /api/sessions/:id returns session object', async () => {
+  test('GET /api/sessions/:id returns session object with preview for unauthenticated', async () => {
     const session = seedSession({ is_active: 1, notes: 'Test session' });
 
     const res = await request(app).get(`/api/sessions/${session.id}`);
@@ -17,9 +17,11 @@ describe('GET /api/sessions (regression)', () => {
       expect.objectContaining({
         id: session.id,
         is_active: 1,
-        notes: 'Test session',
+        has_notes: true,
+        notes_preview: 'Test session',
       })
     );
+    expect(res.body.notes).toBeUndefined();
     expect(res.body).toHaveProperty('games_played');
   });