Spec
The model and routes exist. Implement the five handlers in controllers/notes.js; each one's contract is in its comment.
You'll practise the skills every backend task uses:
- input validation → 400; missing → 404; malformed ids → 400
- mass-assignment safety: only update whitelisted fields
- multi-key sorting:
pinned desc, then createdAt desc
- regex search with escaping
Tip: write createNote first, since every other test depends on it.