[jbrooksuk]

Summary

• Add an optional Private note field to incident create/edit forms, independent of incident visibility.
• Store notes in a nullable column positioned after message, with a reversible migration.
• Keep notes out of public surfaces and redact them recursively from incident webhooks without hiding normal model attributes.
• Preserve existing webhook relationship data and leave the original incident and its loaded relations unchanged.

Verification

• Full Pest suite: 1,149 passed (4,290 assertions).
• Pint and git diff checks passed.
• Browser-verified create/edit forms and saved note persistence.
• Regression tests cover creating, reloading, editing and clearing notes; guest/authenticated status-page and API privacy; nested incident serialization; and queued update/delete webhooks.
• The nested webhook regression failed before the fix and passed afterward.

Closes #482