1.0 tools: shared foundations (identifier, project, since, filters, errors, aliases) #1829

Part of #1827.

Shared pieces every 1.0 tool uses. Lands first in the stack.

• NoteIdentifier: a real type (today identifier is a plain str) with one resolver for path, permalink, memory:// URL, exact title, external id and <project>/path. No fuzzy fallback; a miss is a tool error that points to bm_search.
• One project parameter accepting a name, workspace/project or an id. project_id and workspace are hidden aliases. A <project>/path prefix must agree with project. An explicit project is never re-resolved from the identifier (build_context resolves the first URL segment as a project even when project is passed #1814).
• since / until: one parser for durations, natural language, dates and RFC 3339 instants. Keep the one-day floor and document it everywhere (recent_activity: document the one-day minimum lookback #1816).
• JSON filters: one parser for bm_find and bm_search ($in, $gte, $exists, dot paths).
• Paging: page / page_size, default 10, maximum 100.
• Errors: every refusal is a tool error (isError) with a JSON error code and text that says what to try instead (MCP tools report refusals inconsistently (isError false for read_content/read_note/move_note refusals) #1813).
• Middleware that maps old tool names to the new tools for one release, for direct callers. Hidden tools are refused on call by FastMCP, so this cannot be done with visibility.
• Hidden parameter aliases: file_path → identifier; old_string / new_string / replace_all on bm_edit.