Create endpoints for a Park/Subarea's Notes

#### Description:

Add an endpoint for a user to GET, CREATE, PUT, and DELETE notes for a Park/Subarea.

#### Acceptance Criteria:

- [ ] User can only GET notes for Parks and Subareas they have access to
- [ ] User can only CREATE notes for Parks and Subareas they have access to
- [ ] User can only PUT notes for Parks and Subareas they have access to
- [ ] User can only DELETE notes for Parks and Subareas they have access to

#### Development Checklist:

- [ ] ...
- [ ] ...
- [ ] ...

#### Dependencies

- Blocked by
- [#333](https://github.com/bcgov/bcparks-ar-admin/issues/333)

**Wireframe(s):**

**Workflows:**

**Definition of Ready** (Note: If any of these points are not applicable, mark N/A)

- [ ] User story is included
- [ ] User role and type are identified
- [ ] Acceptance criteria are included
- [ ] Wireframes are included
- [ ] Design / Solution is accepted by Product Owner
- [ Dependencies are identified (technical, business, regulatory/policy)
- [ ] Story has been estimated (under 13 pts)

**Definition of Done**
- In progress:
- [ ] Acceptance criteria are tested (Functionality meets the acceptance criteria defined in the ticket)
- [ ] UI meets accessibility requirements
- [ ] Unit tests are written
- [ ] Work is traceable in GitHub
- [ ] PR linked to ticket number
- [ ] If needed/required - Dev adds flag/label to highlight any migration steps necessary prior to PROD deployment
- Code review:
- [ ] Code is peer reviewed and has passed CI/CD tests
- QA:
- [ ] Acceptance criteria are tested (Functionality meets the acceptance criteria defined in the ticket)
- [ ] Code is potentially shippable to the production environment
- [ ] Functional features have been tested and passed by QA
- [ ] UI components tested by designer
- [ ] Code is deployed to PROD when moved to 'done' column (unless requested otherwise by PO)
- PO Review:
- [ ] Acceptance criteria are tested (Functionality meets the acceptance criteria defined in the ticket)
- [ ] Reviewed and approved by Product Owner

#### Notes:
-
-

Begin by reviewing and resolving the dependency on issue #333, then inspect the existing API conventions for Park and Subarea access and note persistence. Define the GET, CREATE, PUT, and DELETE behavior against the listed access-control criteria, add unit and acceptance coverage, and confirm all four operations reject inaccessible resources.

Written by the indexing model from the issue text.