feat(sase): founder notes — Phase A of user mutations

Panel-side only — first writable feature on the Sase user detail page.
Notes are stored in the panel database (sase_user_notes); the spoke is
never touched (KVKK minimize).

Model
- SaseUserNote { id, saseUserId, authorUserId, body, pinned, createdAt }
- Index on (saseUserId, pinned, createdAt) for the default render order

API
- GET  /api/sase/users/[id]/notes — list (pinned first, then newest)
- POST /api/sase/users/[id]/notes — { body, pinned } create (audit'li)
- PATCH/DELETE /api/sase/notes/[noteId] — toggle pin / hard delete

UI
- New "Notlar" tab on user detail. Textarea + pinned checkbox + submit;
  list shows TR-localized timestamps, per-row pin/unpin and delete.

Schema sync
- package.json `start` now runs `prisma db push --skip-generate` before
  `next start`. Panel uses db-push style (no migrations dir); this lets
  the new table land on next deploy without a separate manual step.
  Future destructive changes will require a smarter migration approach.

teknikborc.md updated: super_panel_reader role still needs to be created
on the new sase-postgres (current panel uses sase superuser).

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

apps/web/prisma/schema.prisma

@@ -363,3 +363,20 @@ model EvalRun {
   @@index([promptTag, promptVersion])
   @@map("eval_runs")
 }
+
+// ---------- Phase 7a: Sase user-management ----------
+
+// Founder-only notes pinned to a Sase user. Stored panel-side (KVKK minimize:
+// the spoke is never written to). Append-only from the UI — delete is allowed
+// while we're early; can tighten to audit-only soft-delete later.
+model SaseUserNote {
+  id           String   @id @default(cuid())
+  saseUserId   String   @map("sase_user_id")
+  authorUserId String   @map("author_user_id") // panel User.id
+  body         String
+  pinned       Boolean  @default(false)
+  createdAt    DateTime @default(now()) @map("created_at")
+
+  @@index([saseUserId, pinned, createdAt])
+  @@map("sase_user_notes")
+}