List all notes for a specific user.

Notes are returned with pinned notes first, then ordered by creation date descending.

Required permission: Notes.view

For a partner or sub-operator API token, this endpoint returns 404 Not Found if the requested resource or its parent is outside the token's scope. If the target is visible to the token but the token lacks the required read permission, it returns 403 Forbidden.