Fix final annotation review gaps

[johnnygreco]

Issue

Closes #312
Part of #301

Summary

• Preserve annotation provenance on UI, REST, and MCP updates by sending/updating only editable content fields.
• Keep transcript message and event annotation targets distinct when they share an event UID.
• Page scoped REST/MCP annotation lists after target-scope filtering, with MCP result completion based on the visible stream.
• Collapse scoped REST annotation ID misses to the same not-found response and clarify MCP message targeting docs/QA evidence.

Validation

• node --test tests/js/transcript-annotations.test.cjs
• go test ./internal/web -run 'TestAnnotationAPI(CreateListUpdateDeleteSessionAnnotation|ListByAnnotationIDAppliesScope|ListPaginatesAfterScopeFiltering|IDScopeMissReturnsAnnotationNotFound)'
• go test ./internal/mcp -run 'TestTool(ListAnnotations(SessionTargetListsAllSessionAnnotations|FiltersOutOfScopeTargets|PaginatesAfterScopeFiltering|MessageOpenRefRoundTripsFromCreate)|UpdateAndDeleteAnnotationVerifyMessageScope|ToolDefinitionsIncludeAnnotations)'
• make generate-check
• make fmt-check
• npm run test:frontend
• make test
• make build
• make lint
• npm run test:e2e
• npm run test:a11y
• npm run test:visual
• BEACON_QA_CAPTURE=1 npx playwright test tests/e2e/trace-annotations-qa.spec.ts --reporter=line
• npx playwright test tests/e2e/trace-annotations-qa.spec.ts --reporter=line
• git diff --check

Risks / Reviewer Notes

• This intentionally does not support old update payloads that mutate provenance.
• Scoped annotation lists now scan raw annotation pages until the visible page is filled; this keeps API semantics correct without adding transport-specific scope fields to the store filter.

[johnnygreco]

Review Record

Frozen target: feature/trace-annotations 75333db4bb937ac57c0046364c48a1f15bc7ac89..issue-312-final-annotation-review-fixes 7fcaf9af9c57545565a5c5885fb8c251584a0830
Diff command: git diff 75333db4bb937ac57c0046364c48a1f15bc7ac89..7fcaf9af9c57545565a5c5885fb8c251584a0830

Panel:

• Banach: UI behavior and dataset provenance -> clean
• Aquinas: REST API correctness/security -> clean
• Heisenberg: MCP agent tools and schema ergonomics -> clean
• Harvey: docs, QA, test coverage, maintainability -> clean

Skipped Review-Standard lenses: none

Accepted findings fixed:

• None from PR Fix final annotation review gaps #313 review. PR Fix final annotation review gaps #313 itself fixes final holistic review findings from GitHub goal delivery: trace and session annotations #301: UI/MCP provenance rewriting on update, message/event target key conflation, scoped annotation-list pagination, scoped REST ID endpoint enumeration, MCP message-target docs ambiguity, and scoped QA evidence URL mismatch.

Rejected findings:

• None

Validation after fixes:

• node --test tests/js/transcript-annotations.test.cjs -> passed
• go test ./internal/web -run 'TestAnnotationAPI(CreateListUpdateDeleteSessionAnnotation|ListByAnnotationIDAppliesScope|ListPaginatesAfterScopeFiltering|IDScopeMissReturnsAnnotationNotFound)' -> passed
• go test ./internal/mcp -run 'TestTool(ListAnnotations(SessionTargetListsAllSessionAnnotations|FiltersOutOfScopeTargets|PaginatesAfterScopeFiltering|MessageOpenRefRoundTripsFromCreate)|UpdateAndDeleteAnnotationVerifyMessageScope|ToolDefinitionsIncludeAnnotations)' -> passed
• make generate-check -> passed
• make fmt-check -> passed
• npm run test:frontend -> passed
• make test -> passed
• make build -> passed
• make lint -> passed
• npm run test:e2e -> passed, 53/53
• npm run test:a11y -> passed, 10/10
• npm run test:visual -> passed, 8/8
• BEACON_QA_CAPTURE=1 npx playwright test tests/e2e/trace-annotations-qa.spec.ts --reporter=line -> passed, 3/3
• npx playwright test tests/e2e/trace-annotations-qa.spec.ts --reporter=line -> passed, 3 skipped as designed
• git diff --check -> passed
• GitHub CI on 7fcaf9af9c57545565a5c5885fb8c251584a0830 -> passed: format, generated, govulncheck, npm-audit, frontend, dependency-review, test, lint, build, playwright-dashboard, playwright-accessibility

Final status: all reviewers clean; no unresolved blockers.