feat: add user-scoped favorites and notes

app/scouting/models.py

@@ -1,3 +1,4 @@
+from django.conf import settings
 from django.db import models
 
 
@@ -164,25 +165,34 @@ class PlayerSeasonStats(models.Model):
 
 
 class FavoritePlayer(models.Model):
-    # Phase-2 MVP uses a single shared development shortlist instead of user-scoped
-    # favorites so the workflow stays useful without introducing auth complexity yet.
-    player = models.OneToOneField(
+    user = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name="favorite_players",
+    )
+    player = models.ForeignKey(
         Player,
         on_delete=models.CASCADE,
-        related_name="favorite_entry",
+        related_name="favorite_entries",
     )
     created_at = models.DateTimeField(auto_now_add=True)
 
     class Meta:
         ordering = ["-created_at", "player__full_name"]
+        constraints = [
+            models.UniqueConstraint(fields=["user", "player"], name="uniq_favorite_player_per_user"),
+        ]
 
     def __str__(self) -> str:
-        return f"Favorite: {self.player.full_name}"
+        return f"Favorite: {self.user} -> {self.player.full_name}"
 
 
 class PlayerNote(models.Model):
-    # Phase-2 MVP keeps notes shared within the local development environment so
-    # scouting observations can be used immediately without introducing auth yet.
+    user = models.ForeignKey(
+        settings.AUTH_USER_MODEL,
+        on_delete=models.CASCADE,
+        related_name="player_notes",
+    )
     player = models.ForeignKey(
         Player,
         on_delete=models.CASCADE,
@@ -196,4 +206,4 @@ class PlayerNote(models.Model):
         ordering = ["-created_at", "-id"]
 
     def __str__(self) -> str:
-        return f"Note for {self.player.full_name}"
+        return f"Note by {self.user} for {self.player.full_name}"