Authorize private note creation

[bjarn]

Summary

• Require staff access before the comment component creates a private note.
• Keep normal public comment behavior unchanged.
• Add tests for forged component state and valid administrator and employee use.

Security impact

A normal authenticated user could forge Livewire state and create a staff-only private note.

Tests

• php artisan test --compact tests/Feature/Livewire/Item/CommentsTest.php