[ashwinuae]

The private incident notes introduced in #483 were dashboard-only. This PR adds read and write support over the API, gated behind a new token ability.

Changes

• New ability incident-private-notes.manage, shown in the API key permissions form as "Manage Incident Private Notes".
• Write: the incident request DTOs accept a nullable private_note. Create and update return 403 if the key is present without the ability.
• Read: the incident API resource emits private_note only when the token holds the ability. This covers list, show, and include=incident on incident updates.
• Logged-in sessions now see the note on the API, consistent with the dashboard. The Add dashboard-only private incident notes #483 status page test asserting otherwise was split.
• MCP: create_incident strips private_note before building the DTO.
• Helper text no longer claims the note is excluded from API responses.

Not changed

• Webhooks and subscriber notifications stay redacted.
• Clearing a note over the API is unsupported, matching the nullable date fields where the base DTO drops nulls.