notion-datasource-sync: define views and optional Notion API surfaces

Parent epic: #698

Problem

View inventory and webhook hints exist in limited form, but Notion views and optional API surfaces need explicit authority boundaries before they can be promoted.

Current Evidence

• View inventory is read-only and non-authoritative for row membership.
• No view create/update/delete command path or query-through-view authority model is implemented.
• Webhook dirty hints are wired into watch mode.
• Templates, comments/discussions, and user/profile privacy boundaries are not evidenced as complete.

Scope

• Define view create/update/delete authority, base hashes, cleanup semantics, and cache/version behavior.
• Decide whether query-through-view is only a display/read model or can ever produce membership proof.
• Gate behavior on Notion API version when view endpoints differ.
• Model templates as read-only inventory or future row-creation source.
• Keep comments/discussions out of body sync unless a separate comment authority, anchoring model, and attachment identity exist.
• Treat user/profile fields as permission-shaped partial identity; canonical identity should use stable user IDs.

Repro / Proof Instructions

1. Add fake-service tests for view inventory and any candidate view write command before live mutation.
2. For live view mutations, use disposable views with cleanup proof.
3. For query-through-view, prove pagination, cache semantics, and absence classification rules.
4. For comments/templates/users, start with read-only inventory and fail-closed write attempts.

Acceptance Criteria

• Views are never used as implicit row-membership authority without explicit proof.
• View writes fail closed until stale-base, cleanup, API-version, and cache semantics are modeled.
• Optional surfaces are documented as supported, read-only, feasible follow-up, or out of scope.

Start with parent epic #698 and the existing view inventory and watch-mode webhook behavior. Define and document explicit authority, stale-base, cleanup, API-version, cache, and membership-proof boundaries, then add fake-service tests for view inventory and candidate writes. Done means optional surfaces are classified and view writes fail closed until those semantics are proven.