SideNotes 2.3.0

Internal, staff-only notes for Omeka Classic Items and Collections. This
release makes notes available through the Omeka API so scripts and external
tools can create and update them, and brings in the interface and reliability
work from 2.2.

Upgrading: replace the SideNotes folder in omeka/plugins/ with this
version, then go to Plugins → Upgrade next to Side Notes. There is no
schema change and existing notes are preserved.

Added

• Notes are available through the API at /api/side_notes (index, get,
  post, put, delete), for reading and writing notes programmatically.
• POST is an upsert. Send record_type, record_id and note; the note
  is created, or replaced if that record already has one. A record can only
  hold one note, so callers never need to check first. created and
  created_by_user_id survive an overwrite, keeping the audit trail intact.
• ?record_type= and ?record_id= filters on the index action.
• Pagination on the Notes browse page, following the admin
  "results per page" setting.
• Identifier column, showing the Dublin Core Identifier, or the record
  number (#150) where none is set — useful when records share a title.
• Batch delete: per-row checkboxes, select-all, and a "Delete Selected" bar.
• Inline editing: edit a note directly on the browse page without opening
  the Item or Collection.

Changed

• Admin UI follows the native Omeka admin theme: native table styling,
  sortable headers, section-nav tabs and action-links.
• Stored <br /> markup in note text is normalised to real line breaks
  wherever notes are displayed.

Fixed

• Deleting a note no longer lands on a 404. url() already includes the admin
  base path and the redirector prepended it again, producing
  /admin/admin/.... The redirect now returns to the notes list, preserving
  tab, sort order and page.

Security

• Notes declare an ACL resource, are denied to everyone by default, and are
  then granted to the super and admin roles.
• Omeka's API index action performs no per-record permission check — it
  returns whatever the table query yields (core hides private items the same
  way, by filtering inside the table). Table_SideNote::applySearchFilters
  enforces the check itself and fails closed, so an anonymous listing returns
  an empty set rather than every note.
• Verified against a live install: unauthenticated GET by id, POST and
  DELETE return 403, and an unauthenticated listing returns [].

Compatibility

• Omeka Classic 2.0+ (developed and tested against 3.2.1). Requires PHP 5.6+.

---

Full history: see CHANGELOG.md.