feat: full plan execution - CI/CD, critical fixes, UX polish, secondary/advanced features, E2E + docs

Phase 0 (CI/CD): fix root typecheck to cover api+worker+web; reconcile migration
story into idempotent db:migrate (db:sync + db:triggers); add Gitea Actions
quality/deploy/smoke workflow; rewrite README/AGENTS/DEPLOY docs; add
requireWorkspaceAccess + recordActivityForEntity conventions.

Phase 1 (critical fixes): calendar delete + drag/resize DnD; canvas card CRUD +
bulk save + debounced autosave; logout route; graph edge workspaceId derivation;
real analytics endpoints (drop Math.random); task board droppable columns +
reorder persistence; Tiptap notes editor with sanitized HTML rendering; remove
insecure passkey auth; domain/owner scoping (IDOR) on all by-ID routes + search/
export/realtime scoping; command palette routing + agent mention fetch; agent
activity SSE handler; graph fly-to with tracked positions.

Phase 2 (UX polish): login on design system; Sonner toasts app-wide; shared
Loading/Empty/Error state components; working density/sidebarPos/reduce-motion
settings; Inter typography; consolidated status-colors lib; unified detail
routes; dashboard sort/realtime/responsive fixes; mobile responsive; a11y
(radiogroups, sanitized snippets, badge labels).

Phase 3 (features): daily notes timezone fix + delete + autosave + mood/energy
create; active-domain store + topbar picker; graph domain picker + navigable
entity links; tag assign/remove UI + server-side tag filter; real CSV export +
import validation; custom fields on tasks.

Phase 4 (advanced): migrate job worker into apps/worker (webhook delivery with
HMAC, recurring spawn, ai_dispatch disabled); webhook queue helper + entity
event enqueuing + test endpoint fix; recurring scheduledJobs pipeline; agents
CRUD + permission editing + activity filters; real notifications feed; MCP
polish (validation, error codes, domain scoping, dead sql leftover).

Phase 5 (E2E + docs): rewrite Playwright suite for the Vite SPA (15 specs, new
auth helpers, chromium-only in CI); add ephemeral-Postgres e2e CI job; rewrite
docs/API.md for the real Hono API.

apps/api/src/routes/daily-notes.ts

@@ -1,7 +1,7 @@
 import { Hono } from "hono";
 import { db, dailyNotes } from "@project-e/db";
 import { and, desc, eq } from "drizzle-orm";
-import { requireAuth, resolveActiveDomain, AuthError } from "../middleware/auth";
+import { requireAuth, resolveActiveDomain, requireWorkspaceAccess, AuthError } from "../middleware/auth";
 import { recordActivity } from "../middleware/activity";
 import { z } from "zod";
 
@@ -33,6 +33,7 @@ dailyNoteRoutes.get("/", async (c) => {
       const active = await resolveActiveDomain(user);
       domainId = active.id;
     }
+    await requireWorkspaceAccess(c, domainId);
 
     if (dateStr) {
       const startOfDay = new Date(dateStr + "T00:00:00.000Z");
@@ -70,6 +71,8 @@ dailyNoteRoutes.post("/", async (c) => {
       domain: body.domain || (await resolveActiveDomain(user)).id,
     });
 
+    await requireWorkspaceAccess(c, data.domain);
+
     const [note] = await db.insert(dailyNotes).values({
       date: new Date(data.date + "T00:00:00.000Z"),
       content: data.content ?? null,
@@ -104,6 +107,8 @@ dailyNoteRoutes.patch("/:id", async (c) => {
     const [existing] = await db.select().from(dailyNotes).where(eq(dailyNotes.id, id)).limit(1);
     if (!existing) return c.json({ error: { code: "NOT_FOUND", message: "Daily note not found" } }, 404);
 
+    await requireWorkspaceAccess(c, existing.domainId);
+
     const updateValues: Record<string, unknown> = {};
     if (data.content !== undefined) updateValues.content = data.content;
     if (data.mood !== undefined) updateValues.mood = data.mood;
@@ -126,3 +131,30 @@ dailyNoteRoutes.patch("/:id", async (c) => {
     return c.json({ error: { code: "INTERNAL_ERROR", message: "Failed to update daily note" } }, 500);
   }
 });
+
+// DELETE /api/daily-notes/:id — Delete a note
+dailyNoteRoutes.delete("/:id", async (c) => {
+  try {
+    const user = await requireAuth(c);
+    const id = c.req.param("id");
+
+    const [existing] = await db.select().from(dailyNotes).where(eq(dailyNotes.id, id)).limit(1);
+    if (!existing) return c.json({ error: { code: "NOT_FOUND", message: "Daily note not found" } }, 404);
+
+    await requireWorkspaceAccess(c, existing.domainId);
+
+    // daily_notes has no deleted_at column, so this is a hard delete.
+    await db.delete(dailyNotes).where(eq(dailyNotes.id, id));
+
+    await recordActivity({
+      actor: user.name, action: "deleted", entityType: "daily_note", entityId: id,
+      changes: { date: existing.date.toISOString() }, workspaceId: existing.domainId,
+    });
+
+    return c.body(null, 204);
+  } catch (error) {
+    if (error instanceof AuthError) return c.json({ error: { code: error.code, message: error.message } }, error.status as any);
+    console.error("[daily-notes] DELETE error:", error);
+    return c.json({ error: { code: "INTERNAL_ERROR", message: "Failed to delete daily note" } }, 500);
+  }
+});