This is now entirely handled by `create_note`:

1. Project snippets prevent `create_note`.
2. Uploads already only support routing for personal snippets.

This simplifies some policies and access checks, too!