feat(properties): prepare property commands before execution

- Create missing note files before running property:set.
- Default date-only datetime values to midnight.
- Keep property names out of path authorization checks.
- Split policy, vault, daily note, and command target helpers.
- Split n8n node args, description, output, and API response helpers.
- Split API tests by auth, command, daily note, and property behavior.
- Bump API and n8n node versions.

tests/test_property_commands.py

@@ -0,0 +1,58 @@
+from conftest import client, use_jwt_auth, use_work_vault
+
+def test_property_set_name_is_not_treated_as_path(monkeypatch, tmp_path):
+  vault = tmp_path / "vault"
+  vault.mkdir()
+  use_work_vault(monkeypatch, vault)
+  token = use_jwt_auth(monkeypatch, {"sub": "journal", "commands": ["property:set"], "vaults": ["work"], "paths": ["00. Journal/"]})
+
+  response = client.post(
+    "/commands",
+    headers={"Authorization": f"Bearer {token}"},
+    json={"args": ["vault=work", "property:set", "path=00. Journal/Note.md", "name=from", "value=Daniel", "type=text"], "cwd": str(vault)},
+  )
+
+  assert response.status_code == 200
+  assert response.json()["command"] == ["python", "vault=work", "property:set", "path=00. Journal/Note.md", "name=from", "value=Daniel", "type=text"]
+
+def test_property_set_creates_missing_file(monkeypatch, tmp_path):
+  vault = tmp_path / "vault"
+  vault.mkdir()
+  use_work_vault(monkeypatch, vault)
+  token = use_jwt_auth(monkeypatch, {"sub": "journal", "commands": ["property:set"], "vaults": ["work"], "paths": ["00. Journal/"]})
+
+  response = client.post(
+    "/commands",
+    headers={"Authorization": f"Bearer {token}"},
+    json={"args": ["vault=work", "property:set", "path=00. Journal/New.md", "name=from", "value=Daniel", "type=text"], "cwd": str(vault)},
+  )
+
+  assert response.status_code == 200
+  assert (vault / "00. Journal" / "New.md").exists()
+
+def test_property_set_datetime_defaults_missing_time(monkeypatch, tmp_path):
+  vault = tmp_path / "vault"
+  vault.mkdir()
+  use_work_vault(monkeypatch, vault)
+  token = use_jwt_auth(monkeypatch, {"sub": "journal", "commands": ["property:set"], "vaults": ["work"], "paths": ["00. Journal/"]})
+
+  response = client.post(
+    "/commands",
+    headers={"Authorization": f"Bearer {token}"},
+    json={"args": ["vault=work", "property:set", "path=00. Journal/New.md", "name=from", "value=2026-06-24T", "type=datetime"], "cwd": str(vault)},
+  )
+
+  assert response.status_code == 200
+  assert response.json()["command"] == ["python", "vault=work", "property:set", "path=00. Journal/New.md", "name=from", "value=2026-06-24T00:00:00", "type=datetime"]
+
+def test_rename_name_is_treated_as_path(monkeypatch):
+  token = use_jwt_auth(monkeypatch, {"sub": "journal", "commands": ["rename"], "vaults": ["*"], "paths": ["00. Journal/"]})
+
+  response = client.post(
+    "/commands",
+    headers={"Authorization": f"Bearer {token}"},
+    json={"args": ["rename", "path=00. Journal/Old.md", "name=Private/New.md"]},
+  )
+
+  assert response.status_code == 403
+  assert response.json()["detail"].startswith("token is not allowed to access path: Private/New.md")