feat(api): expose owner_notes in capa GET and PATCH

Adds owner_notes to the GET select query and PATCH allowed fields list to enable reading and writing owner notes for CAPA actions.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

app/api/capa/[id]/route.ts

@@ -18,6 +18,7 @@ export async function GET(
     .select(`
       id, incident_id, root_cause_ref, description, owner_user_id, department,
       due_date, priority, status, completed_at, verified_by, verified_at, created_at,
+      owner_notes,
       incidents (reference_no, incident_type),
       owner:users!owner_user_id (name, email)
     `)
@@ -65,7 +66,7 @@ export async function PATCH(
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 
-  const allowed = ['description', 'due_date', 'priority', 'status', 'department', 'root_cause_ref']
+  const allowed = ['description', 'due_date', 'priority', 'status', 'department', 'root_cause_ref', 'owner_notes']
   const update: Record<string, unknown> = {}
   for (const key of allowed) {
     if (key in body) update[key] = body[key]