feat(properties): prepare property commands before execution

- Create missing note files before running property:set.
- Default date-only datetime values to midnight.
- Keep property names out of path authorization checks.
- Split policy, vault, daily note, and command target helpers.
- Split n8n node args, description, output, and API response helpers.
- Split API tests by auth, command, daily note, and property behavior.
- Bump API and n8n node versions.

tests/test_commands.py

@@ -0,0 +1,57 @@
+from conftest import client, jwt
+
+def test_health():
+  response = client.get("/health")
+
+  assert response.status_code == 200
+  body = response.json()
+  assert body["ok"] is True
+  assert "vault" in body
+  assert body["cli"] == "python"
+  assert body["jwt"] is True
+
+def test_command_runs_configured_cli_only():
+  response = client.post(
+    "/commands",
+    headers={"Authorization": f"Bearer {jwt()}"},
+    json={"args": ["--version"], "timeout": 5},
+  )
+
+  assert response.status_code == 200
+  body = response.json()
+  assert body["exit_code"] == 0
+  assert body["command"] == ["python", "--version"]
+  assert "Python" in body["stdout"]
+  assert body["timed_out"] is False
+
+def test_plain_command_string_is_rejected():
+  response = client.post(
+    "/commands",
+    headers={"Authorization": f"Bearer {jwt()}"},
+    json={"command": "--version"},
+  )
+
+  assert response.status_code == 400
+  assert response.json()["detail"] == "command strings are not allowed; use args as a list of strings"
+
+def test_shell_mode_is_rejected():
+  response = client.post(
+    "/commands",
+    headers={"Authorization": f"Bearer {jwt()}"},
+    json={"mode": "shell", "args": ["echo nope"]},
+  )
+
+  assert response.status_code == 400
+  assert response.json()["detail"] == "mode is not allowed; only the configured Obsidian CLI can be executed"
+
+def test_command_timeout():
+  response = client.post(
+    "/commands",
+    headers={"Authorization": f"Bearer {jwt()}"},
+    json={"args": ["-c", "import time; time.sleep(2)"], "timeout": 0.1},
+  )
+
+  assert response.status_code == 200
+  body = response.json()
+  assert body["exit_code"] == 124
+  assert body["timed_out"] is True