Refetch notes on stage change so obfuscation clears

[ellgreen]

Summary

Moving a retro from reflect to group left other people's notes stuck showing reflect-stage obfuscated noise. Obfuscation is recomputed correctly per request from the retro's current status, but nothing re-fetched notes when that status changed - a per-stage remount used to do this as a side effect until "Keep the notes when the stage changes" (dabd046) removed it, and no replacement was added for the already-open board.

• Wires status_updated to trigger the existing reconnect refetch, so an open board asks again (and gets correctly de-obfuscated content) on every stage change.
• Fixes two more instances of the same underlying pattern found while tracing this:
  • dal.NoteList had no ORDER BY, so a full notes fetch (now happening on every stage change too) had no stable order.
  • The note_created reducer case always appended the server-confirmed note to the end instead of swapping it in at the optimistic placeholder's own position, which could reorder notes as people created them concurrently.
  • VotesWithCountFromModel built its result by ranging over a map, so vote-count order in discuss was non-deterministic - the classic Go map-iteration bug.

Test plan

• go build ./... && go vet ./... && go test -race ./...
• cd ui && pnpm lint && pnpm exec tsc -b && pnpm test && pnpm build
• New regression tests at every level: dal/resources/controllers tests against real SQLite, a Vitest reducer case, and a Playwright E2E suite (ui/e2e/reflect-to-group-obfuscation.spec.ts) driving two real browser sessions through the actual reflect → group transition.
• Verified the E2E test actually catches the regression: reverted just the fix, rebuilt, and it failed showing literal obfuscated noise ("n nadkvhktgwh ampapnb qnxc xul uusmaf vvagj") instead of the typed note; restored the fix and it passed cleanly across repeated runs.
• Added a CI job to run the Playwright suite, and pnpm test:e2e documented in CLAUDE.md.

🤖 Generated with Claude Code