fix: align MCP server schema with memento-note + per-request user isolation

- Remove `embedding` column from MCP Note model (dropped by migration 20260425120000)
- Add missing columns: trashedAt, dismissedFromRecent, contentUpdatedAt, cardSizeMode
- Add NoteEmbedding model and Label.notebook relation
- Use AsyncLocalStorage to pass authenticated userId from API key to tool handlers
- Enable SSE mode and auth in docker-compose for N8N integration

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

mcp-server/index-sse.js

@@ -30,6 +30,7 @@ import express from 'express';
 import cors from 'cors';
 import { registerTools } from './tools.js';
 import { validateApiKey, resolveUser } from './auth.js';
+import { requestContext } from './request-context.js';
 
 const __filename = fileURLToPath(import.meta.url);
 const __dirname = dirname(__filename);
@@ -143,6 +144,7 @@ app.use(async (req, res, next) => {
         req.userSession = {
           id: randomUUID(),
           name: 'Static API Key User',
+          userId: process.env.USER_ID || null,
           connectedAt: new Date().toISOString(),
           lastSeen: new Date().toISOString(),
           requestCount: 0,
@@ -231,7 +233,6 @@ const server = new Server(
 );
 
 registerTools(server, prisma, {
-  userId: process.env.USER_ID || null,
   appBaseUrl,
 });
 
@@ -314,7 +315,11 @@ app.all('/mcp', async (req, res) => {
     await server.connect(transport);
   }
 
-  await transport.handleRequest(req, res, req.body);
+  // Pass authenticated userId to tool handlers via AsyncLocalStorage
+  const ctx = { userId: req.userSession?.userId || null };
+  await requestContext.run(ctx, async () => {
+    await transport.handleRequest(req, res, req.body);
+  });
 });
 
 // Legacy /sse redirect for backward compat
@@ -341,7 +346,7 @@ Sessions: http://localhost:${PORT}/sessions
 
 Database: ${databaseUrl}
 App URL:  ${appBaseUrl}
-User filter: ${process.env.USER_ID || 'none (all data)'}
+User filter: per-request (from auth)
 Auth: ${process.env.MCP_REQUIRE_AUTH === 'true' ? 'ENABLED' : 'DISABLED (dev mode)'}
 Timeout: ${REQUEST_TIMEOUT}ms