Live collaboration with Yjs over ActionCable

All editors now work on a server document at the same time instead of
taking turns behind an edit lock.

- The document's content is a sequence of Yjs updates (document_updates);
  DocumentChannel stores and relays them immediately, checks access on
  subscribe and again whenever links or memberships change.
- app/frontend/collab/: the store stays position-based; a binding maps it
  to a Yjs form with stable row/column ids, so a row inserted by one
  person doesn't misplace what another is typing. Remote changes are
  applied only after pending local ones went into Yjs.
- Per-person undo (Y.UndoManager), presence via awareness: the others'
  selections as coloured boxes with names, avatars in the toolbar.
- Existing JSON documents convert on first open, deterministically, so
  two people opening one at once end up with the same Yjs state.
- Editors compact the stored updates after 200 and keep a JSON snapshot
  current for export and duplicating. Edit lock and polling are gone.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/controllers/api/documents_controller.rb

@@ -23,32 +23,21 @@ module Api
       render json: { document: doc.meta_json(role: :owner) }, status: :created
     end
 
-    # GET /api/documents/:id[?known_version=n]
-    # With known_version: just the metadata when nothing changed since.
+    # GET /api/documents/:id[?content=0]
+    # The content is the JSON snapshot the editors keep current (the live
+    # content comes through DocumentChannel).
     def show
       touch_membership
-      meta = @doc.meta_json(role: @role).merge(lock: @doc.lock_info(lock_holder))
-      if params[:known_version].present? && params[:known_version].to_i == @doc.version
-        render json: { document: meta, unchanged: true }
-      else
-        render json: { document: meta.merge(content: @doc.content) }
-      end
+      meta = @doc.meta_json(role: @role)
+      meta[:content] = @doc.content unless params[:content] == "0"
+      render json: { document: meta }
     end
 
-    # PATCH /api/documents/:id { title } and/or { content, base_version }
+    # PATCH /api/documents/:id { title }
     def update
       return forbidden unless Document.role_at_least?(@role, :editor)
-      if params.key?(:content)
-        return render(json: { error: "locked", holder_name: @doc.lock_holder_name }, status: :locked) if @doc.locked_by_other?(lock_holder)
-        @doc.with_lock do
-          if params.require(:base_version).to_i != @doc.version
-            return render(json: { error: "conflict", version: @doc.version }, status: :conflict)
-          end
-          @doc.update!(content: content_param, version: @doc.version + 1,
-                       content_updated_at: Time.current, updated_by: Current.user)
-        end
-      end
-      @doc.update!(title: params[:title]) if params[:title].present?
+      @doc.update!(title: params.require(:title))
+      @doc.broadcast({ type: "meta", title: @doc.title })
       render json: { document: @doc.meta_json(role: @role) }
     end
 
@@ -56,8 +45,10 @@ module Api
     def destroy
       if @role == :owner
         @doc.destroy!
+        @doc.broadcast({ type: "revoked" })
       elsif Current.user
         @doc.document_memberships.where(user: Current.user).delete_all
+        @doc.revalidate_access!
       else
         return forbidden
       end