Add an admin-only "notes" field to requests

Right now if we want to make notes on a request we need to edit the request. That's error-prone and eventually will create problems.

Instead, each request should have a separate "notes" field. Only admins should be able to review and edit this field.