VOIP-1271-service-agent-case-contact-notes-endpoints

[pchero]

Add service_agents endpoints for case contact-linking and notes, reusing existing admin-only domain logic for the agent-facing surface. square-talk's redesigned Case Detail page needs an agent to be able to link/unlink a case's contact and to read/write case notes, neither of which square-talk (agent-facing) could reach before this change.

• bin-openapi-manager: Add put: to service_agents/contact_cases/{id} for contact attach/detach
• bin-openapi-manager: Add service_agents/contact_cases/{id}/notes and .../notes/{note_id} paths (list/create/delete), POST body restricted to text only (author derived server-side, never client-supplied)
• bin-api-manager: Add ServiceAgentCaseUpdateContact, mirroring admin CaseUpdateContact with PermissionAll gate
• bin-api-manager: Add ServiceAgentCaseNoteList/Create/Delete; Create derives author from the caller's own agent identity (cmcasenote.AuthorTypeAgent + a.AgentID()); Delete restricts to the note's own author via a list-then-match lookup (no single-note-get RPC exists); both reject non-agent identities (accesskey/delegate/direct) since AgentID() is meaningless for them
• bin-api-manager: Add PutServiceAgentsContactCasesId and Get/Post/DeleteServiceAgentsContactCasesIdNotes* server handlers
• bin-api-manager: Add servicehandler and server-level tests covering agent-permission success, tenant isolation, direct/accesskey rejection, and note-ownership enforcement (author mismatch, nil author, not found)