Comments and notes module: a thread on any record

Part of #249.

A thread or note attached to any record: a comment on a content entry, a note on a contact, an internal remark on a survey response. One threading model, reused everywhere, rather than each module inventing its own.

Three unrelated systems that reuse it: a CRM (notes on a deal), a helpdesk (replies on a ticket), a CMS (editorial comments on a draft). Primitive.

Contract:
- A Comment with an author, a target record (id and type), a body, a parent for threading, and timestamps.
- Public input is whitelisted and escaped on the way out, since a comment renders in an administrator's browser (same rule the report endpoint already follows).
- Tenant-scoped, RBAC-gated, queryable by target.

Done when: a module ships with tests (post, thread, list by target, tenant isolation, escaping), an admin surface, and a doc showing two record types sharing the comment surface.