Split API notes publish route

[yvette-carlisle]

Summary

• Split API notes publish/unpublish implementation bodies into apps/elf-api/src/routes/notes/publish.rs.
• Keep the annotated route handlers in notes.rs so utoipa path symbols and route registration stay stable.
• Preserve request parsing, org-shared admin enforcement, service request construction, and response formatting.

Validation

• cargo make fmt-rust
• cargo make check-rust
• cargo make lint-vstyle
• git diff --check
• cargo make lint-rust
• cargo make test-rust
• cargo make check
• cargo make test-rust-integration
• cargo make check-trace-gate
• staged skeptic review: pass, no blockers or risks