[NRT-771] Post-flag-flip cleanup: drop AUTO_PROTECT_FEATURE_FLAG scaffolding + thread NoteDiff

[RisingOrange]

Related issues

• NRT-771
• Follow-up to NRT-749 ([NRT-749] Redesign Suggest-a-change dialog with "Include in suggestion" section #1288); origin write-up in notes/nrt749-deferred-refactors.md (feat: authorize add on #4).

Proposed changes

auto_protect_fields_when_edited is now permanent for all users, so this removes the feature-flag scaffolding NRT-749 added. It also lands a related performance cleanup that was deliberately deferred until the flag was gone — reusing the per-note diff computed when the suggestion dialog opens instead of recomputing it on submit (see §3 for why the flag blocked it).

1. Remove AUTO_PROTECT_FEATURE_FLAG scaffolding

• Delete the constant + its now-unused config import in main/suggestions.py.
• Inline the 4 gate sites so the gated code always runs:
  • editor.py — auto-protect-on-unfocus hook (drops the early-return flag check).
  • suggestion_dialog.py — the bulk empty-state gate and the _setup_ui field-selection-widget gate.
  • decks_dialog.py — the "Automatically protect fields when edited" box is always shown.
• Both suggestion builders now pass include_protected_fields=True unconditionally.

2. Tighten BulkSuggestionFilters

• fields_to_include_by_mid is now required (drops Optional); for_mid no longer has a None "ship-everything" branch. The dialog's widget always renders and produces a concrete per-mid selection, so None was unreachable legacy. Empty-construction sites pass {}.

3. Reuse the note-diff on submit instead of recomputing it ("thread NoteDiff to the submit path")

Plain version: When you edit a note and open the suggestion dialog, the add-on computes a NoteDiff per note — what changed versus the version AnkiHub has on record (the changed fields, added/removed tags, new media). That diff is what powers the "Include in suggestion" picker. Previously it was thrown away once the dialog opened: when you hit submit, the builders re-derived the exact same information from scratch — re-converting each note, re-reading the AnkiHub DB, re-comparing fields and tags — plus an extra batch query. This change threads (passes along) that already-computed diff from the dialog through to the submit path, and the submit builders now just apply your selection on top of the diff instead of recomputing it: the diff is computed once and is the single source of truth, and a duplicate AnkiHubNote.filter(...) query is dropped.

Why it was deferred: while the flag existed, the open-time conversion always included protected fields but the submit-time conversion only did so when the flag was on — so reusing the open-time diff could have shipped the wrong content. With the flag gone, both sides behave identically, so reuse is now safe. (Hence folding it into this ticket rather than NRT-749.)

Details: NoteDiff carries local_note: NoteInfo (the local Anki note, paired with ah_note) and changed_fields: List[Field] — the fields a suggestion would ship (changed-vs-AH for existing notes, non-empty for new notes); changed_field_names is a derived property over it. Both the bulk and single-suggestion dialogs thread their open-time compute_note_diffs map to the submit path: _suggestions_for_notes classifies notes from the diff (exists_in_ah_db / is_deleted_on_remote, dropping the duplicate AnkiHubNote.filter(anki_note_id__in=...) batch query) and hands each note's diff to _change_note_suggestion / _new_note_suggestion. Those builders just apply the user's allowlist to changed_fields / added_tags / removed_tags — the field/tag comparison (_fields_that_changed, _added_and_removed_tags) lives only in compute_note_diffs. A builder self-computes the diff when one isn't supplied (standalone callers / tests). BulkSuggestionFilters.fields_to_include_by_mid is required, and within an explicit filter a missing per-mid entry ships none of that note type's fields (the dialog's per-section selection). Passing no filter at all (filters=None) means "no filter — ship everything the diff detected", matching the single-note path; the dialog always passes an explicit selection, so None is a programmatic convenience.

Tests

• Deleted the two flag-off legacy tests; dropped the set_feature_flags({"auto_protect_fields_when_edited": ...}) enabling lines (the per-deck set_auto_protect_fields_when_edited setting stays).
• Gave bulk-path tests explicit fields_to_include_by_mid (the old None "ship-everything" default now ships nothing), and updated the shared mock_suggestion_dialog fixture to build its allowlist from the diffs — mirroring the real widget's default-all-checked selection.

Gating note for reviewer: this ticket is gated on the auto_protect_fields_when_edited flag being permanently flipped on for all users. Worth a final confirmation that the rollout is retired server-side before merge.

How to reproduce

N/a — internal refactor, no user-facing behavior change (given the flag is on for everyone). Covered by tests.

Further comments

Deliberately left PerNoteFilters / suggest_note_update / suggest_new_note filters=None "ship-everything" default in place: unlike the BulkSuggestionFilters map (only ever populated by the dialog widget), that's a sensible default for the general-purpose single-note suggest entry points, not flag residue.