fix(coach): the consent screen names session notes, and they arrive whole

[kurktchiev]

The Coach's payload carries each recent session's note (cleanWorkout in
api/coach/core/payload.js). The consent screen's "Your logged training" line listed weights,
reps, times, effort ratings and how long sessions took, and never mentioned notes. It now ends
"…, and your session notes." The table in docs/AI_COACH.md and the comment in categories.js say
the same. Per-exercise notes are not in the payload, so the line names session notes only.

What the version bump does. CONSENT_VERSION goes from 1 to 2 with the new wording.
hasConsent() wants the current version, so everyone who agreed to version 1 is asked again the
next time they open the Coach, on the web or on the phone: CoachChat sends them to the intake.
Before this change, that redirect replayed all seven intake questions and ended in a new plan
request. Now an athlete who already has a profile sees only the consent step, and "I understand"
takes them back to the Coach with their answers untouched. Someone who never agreed still gets the
full intake.

The server is not part of the bump. enqueue and execute in api/coach/jobs.js, the weekly
cadence and coach-local.js on the phone check only consent.agreedAt. So a weekly review keeps
running for someone who has not opened the Coach since, on the agreement they gave. Making those
four checks want the new version too would pause every weekly review until each person opens the
app, so I left it out; say if you want it. GET /api/coach/disclosure still returns version: 1.
Nothing reads it, and its category list did not change.

The note was cut at 300 characters. The app lets a session note run to 500 (NOTE_MAX in
frontend/src/lib/history.js), so a longer note reached the model cut off mid-sentence. payload.js
has its own NOTE_MAX = 500 now (the api cannot import the frontend), and payload-parity.test.js
pins it to the app's.

Tests, each new one failing against the old code:

• CoachIntake.test.jsx: +2 (35 pass). A returning athlete with an old consent sees only the
  consent step and goes back to the Coach; the training line names session notes.
• api/test/payload.test.js: +1 (28 pass). A 487-character note arrives whole; one longer than
  the app allows is bounded at 500.
• api/test/payload-parity.test.js: +1 (4 pass). The two NOTE_MAX values agree.
• CoachChat.test.jsx (12), CoachChat.fast-failure.test.jsx (4) and CoachChat.demo-failure.test.jsx
  (1) hard-coded consent version 1 in their fixtures and read CONSENT_VERSION now.
• Also run and passing: coach.test.js (67), coach-demo.test.js (35), coach-local.test.js (11),
  coach-parity.test.js (171), the three CoachSetup test files (40), and on the api side
  payload-bounds (11), jobs (25), routes (6), cadence-weekly (9). check-locales.mjs and
  check-source-strings.mjs pass. The consent category lines were never in the locale packs, so
  there is nothing to translate here.

Overlap: #312 conflicts in payload.js (two places, around the constants it removes). #168 also
edits payload.js and coach.js but merges cleanly with this.

🤖 Generated with Claude Code

[DuarteSantos8]

Merged and released in v1.3.10, thanks @kurktchiev!

https://github.com/DuarteSantos8/openGym/releases/tag/v1.3.10