Add Rails backend: accounts via magic link, server documents, sharing

The app becomes a Rails 8 application; the Vue frontend moves to
app/frontend and is served through vite_rails.

- Without an account documents stay in the browser (IndexedDB). Sign-in
  is by magic link or the 6-digit code from the same mail; afterwards
  local documents can be uploaded into the account.
- Server documents (/d/<id>) with versioned saves and a single-editor
  lock per browser tab; others see them read-only and follow by polling.
- Sharing via link (works without an account) and via e-mail invitation,
  roles viewer/editor; the owner manages links and people.
- Store gains a read-only mode that blocks all content changes.
- Solid Queue, Cache and Cable share the one PostgreSQL database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/controllers/api/document_locks_controller.rb

@@ -0,0 +1,29 @@
+module Api
+  # The edit lock of a server document: one browser tab edits at a time,
+  # everyone else sees the document read-only until the lock is released or
+  # expires (Document::LOCK_TTL without a heartbeat).
+  class DocumentLocksController < BaseController
+    before_action :load_document
+
+    # POST /api/documents/:id/lock -- take or refresh (heartbeat)
+    def create
+      return render(json: { lock: { mine: false, holder_name: nil } }) unless Document.role_at_least?(@role, :editor)
+      mine = @doc.acquire_lock!(lock_holder, holder_name)
+      render json: { lock: { mine:, holder_name: (@doc.lock_holder_name unless mine) } }
+    end
+
+    # DELETE /api/documents/:id/lock
+    def destroy
+      @doc.release_lock!(lock_holder)
+      head :no_content
+    end
+
+    private
+
+    def load_document
+      @doc = Document.find(params[:document_id])
+      @role = @doc.role_for(user: Current.user, token: share_token)
+      raise ActiveRecord::RecordNotFound unless @role
+    end
+  end
+end