fix(profile): private notes say they are stored unencrypted on the homeserver (#329)

"Notes only visible to you" overstated it: notes live in plain account
data that homeserver admins can read. Say so under the note box (and
link it as the box's description): "Only you can see this in Lotus Chat.
It's stored on your homeserver and isn't end-to-end encrypted."

Fixes #329

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_017PCb59uY3UKqDqt7B6hzd5

src/app/components/user-profile/UserRoomProfile.tsx

@@ -286,10 +286,11 @@ function UserPrivateNotes({ userId }: { userId: string }) {
       </Box>
       <textarea
         aria-label="Private note about this user"
+        aria-describedby="private-note-storage"
         value={draft}
         onChange={handleChange}
         maxLength={USER_NOTE_MAX_LENGTH}
-        placeholder="Notes only visible to you…"
+        placeholder="Add a private note…"
         rows={3}
         style={{
           width: '100%',
@@ -305,6 +306,11 @@ function UserPrivateNotes({ userId }: { userId: string }) {
           outline: 'none',
         }}
       />
+      {/* [Gitea #329] Account data isn't end-to-end encrypted: say so. */}
+      <Text id="private-note-storage" size="T200" priority="300">
+        Only you can see this in Lotus Chat. It&apos;s stored on your homeserver and isn&apos;t
+        end-to-end encrypted.
+      </Text>
     </Box>
   );
 }