Summary

• adds authenticated /api/notes/generate route for hosted note generation
• disables server-action note generation path in hosted mode
• records note-generation audit events with org/user context

Security impact

• enforces authz context for note generation in hosted deployments
• removes unauthenticated hosted note-generation execution path

PHI handling impact

• keeps note content out of audit metadata
• retains non-PHI audit event structure with redacted/sanitized errors

Tests executed

• pnpm build:test
• pnpm exec tsc --project apps/web/tsconfig.json --noEmit
• pnpm test:no-phi-logs

Rollback plan

• revert this PR to return to prior note generation routing behavior