Add key path and gated note save/load for local note encryption

[keshav0479]

This is for the next backend PR for local note encryption, building on the schema fields from #15557.

The goal is to add the local key path and the gated note load/save path, without making local encryption user-facing yet.

This includes:

• letting EncryptionService use a supplied decrypted key without loading it into the normal E2EE key list
• storing the encrypted local note encryption key in sync info
• adding the local-note-specific key/service wrappers
• adding an explicit useLocalEncryption path for Note.load and Note.save
• handling linked IDs and plaintext history cleanup when a note first becomes locally encrypted