Fix full sync on startup and block locked/protected note access

[s7eve1230]

Without resetting syncToken on startup, fullSync runs incrementally and the server skips unchanged items_key elements. This causes decryption to fail with 'No items_key decrypted' on every cold start.

Also surfaces the Standard Notes locked (edit-lock) flag through the note type and filters locked notes the same way protected notes are filtered: shown as [Protected] in notes_list and blocked in notes_get. Added sync() call in notes_get so protection state reflects the current server state without requiring a Claude Desktop restart.

Problem
Two independent bugs:

On startup, fullSync runs incrementally instead of fetching all items. The syncToken from the previous session is restored from keychain, so the server skips unchanged items_key elements — decryption fails with No items_key decrypted on every cold start.
The Standard Notes locked (edit-lock) flag was not surfaced through the type system, so locked notes were accessible via MCP even when the user had explicitly protected them from editing.

Fix

Reset syncToken to null on startup so fullSync always fetches the full item set including items_key.
Add protected and locked fields to DecryptedNote, Note, and NoteSummary.
Filter locked and protected notes as [Protected] in notes_list.
Block notes_get for locked/protected notes with an explicit error.
Add client.sync() in notes_get so protection state is always fresh from the server.

Testing

Restart Claude Desktop → notes_list loads without decryption errors.
Create a locked note in the Standard Notes app → appears as [Protected] in notes_list, notes_get returns an error.