Write one external feedback note on another account's app.

Any authenticated account may call this route; there is no membership gate. The caller names the target by owner_username and app_name. An unknown pair reads 404. The note lands with kind='external', no thread and no agent_id. The per-account cap users.app_note_cap bounds the caller's external notes across all apps; a refusal reads 400 and leaves one app_note_cap operator notice. The write notifies the app owner and journals one note.feedback event.