Add Rails backend: accounts via magic link, server documents, sharing

The app becomes a Rails 8 application; the Vue frontend moves to
app/frontend and is served through vite_rails.

- Without an account documents stay in the browser (IndexedDB). Sign-in
  is by magic link or the 6-digit code from the same mail; afterwards
  local documents can be uploaded into the account.
- Server documents (/d/<id>) with versioned saves and a single-editor
  lock per browser tab; others see them read-only and follow by polling.
- Sharing via link (works without an account) and via e-mail invitation,
  roles viewer/editor; the owner manages links and people.
- Store gains a read-only mode that blocks all content changes.
- Solid Queue, Cache and Cable share the one PostgreSQL database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/controllers/api/auth_controller.rb

@@ -0,0 +1,37 @@
+module Api
+  class AuthController < BaseController
+    rate_limit to: 20, within: 1.hour, only: :magic_link, with: -> { too_many }
+    rate_limit to: 30, within: 15.minutes, only: :code, with: -> { too_many }
+
+    # POST /api/auth/magic_link { email, return_to }
+    # Always the same answer, so it can't be used to find out who has an account.
+    def magic_link
+      email = params.require(:email).to_s
+      unless MagicLink.throttled?(email)
+        link = MagicLink.issue!(email:, return_to: params[:return_to])
+        AuthMailer.magic_link(link, link.token, link.code).deliver_later
+      end
+      render json: { ok: true }
+    rescue ActiveRecord::RecordInvalid
+      render json: { error: "invalid_email" }, status: :unprocessable_entity
+    end
+
+    # POST /api/auth/code { email, code } -- the 6-digit code from the mail
+    def code
+      link = MagicLink.find_by_code(params.require(:email), params.require(:code))
+      return render(json: { error: "invalid_code" }, status: :unprocessable_entity) unless link
+      start_session_for(link.redeem!)
+      render json: { user: Current.user.as_json, redirect: link.destination }
+    end
+
+    # DELETE /api/auth/session
+    def logout
+      terminate_session
+      render json: { ok: true }
+    end
+
+    private
+
+    def too_many = render(json: { error: "rate_limited" }, status: :too_many_requests)
+  end
+end