Add Rails backend: accounts via magic link, server documents, sharing

The app becomes a Rails 8 application; the Vue frontend moves to
app/frontend and is served through vite_rails.

- Without an account documents stay in the browser (IndexedDB). Sign-in
  is by magic link or the 6-digit code from the same mail; afterwards
  local documents can be uploaded into the account.
- Server documents (/d/<id>) with versioned saves and a single-editor
  lock per browser tab; others see them read-only and follow by polling.
- Sharing via link (works without an account) and via e-mail invitation,
  roles viewer/editor; the owner manages links and people.
- Store gains a read-only mode that blocks all content changes.
- Solid Queue, Cache and Cable share the one PostgreSQL database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/controllers/api/documents_controller.rb

@@ -0,0 +1,87 @@
+module Api
+  # Server documents. Listing and creating need an account; reading and
+  # writing a single document also work with just a share link token.
+  class DocumentsController < BaseController
+    before_action :require_authentication, only: %i[index create]
+    before_action :load_document, except: %i[index create]
+
+    # GET /api/documents -- owned + shared with me
+    def index
+      user = Current.user
+      memberships = user.document_memberships.index_by(&:document_id)
+      docs = user.accessible_documents.includes(:owner, :updated_by).order(content_updated_at: :desc)
+      render json: {
+        documents: docs.map { |d| d.meta_json(role: d.owner_id == user.id ? :owner : memberships[d.id]&.role) }
+      }
+    end
+
+    # POST /api/documents { title, content } -- also used to upload a local document
+    def create
+      doc = Current.user.owned_documents.create!(
+        title: params.require(:title), content: content_param, updated_by: Current.user
+      )
+      render json: { document: doc.meta_json(role: :owner) }, status: :created
+    end
+
+    # GET /api/documents/:id[?known_version=n]
+    # With known_version: just the metadata when nothing changed since.
+    def show
+      touch_membership
+      meta = @doc.meta_json(role: @role).merge(lock: @doc.lock_info(lock_holder))
+      if params[:known_version].present? && params[:known_version].to_i == @doc.version
+        render json: { document: meta, unchanged: true }
+      else
+        render json: { document: meta.merge(content: @doc.content) }
+      end
+    end
+
+    # PATCH /api/documents/:id { title } and/or { content, base_version }
+    def update
+      return forbidden unless Document.role_at_least?(@role, :editor)
+      if params.key?(:content)
+        return render(json: { error: "locked", holder_name: @doc.lock_holder_name }, status: :locked) if @doc.locked_by_other?(lock_holder)
+        @doc.with_lock do
+          if params.require(:base_version).to_i != @doc.version
+            return render(json: { error: "conflict", version: @doc.version }, status: :conflict)
+          end
+          @doc.update!(content: content_param, version: @doc.version + 1,
+                       content_updated_at: Time.current, updated_by: Current.user)
+        end
+      end
+      @doc.update!(title: params[:title]) if params[:title].present?
+      render json: { document: @doc.meta_json(role: @role) }
+    end
+
+    # DELETE /api/documents/:id -- the owner deletes it; anyone else leaves it
+    def destroy
+      if @role == :owner
+        @doc.destroy!
+      elsif Current.user
+        @doc.document_memberships.where(user: Current.user).delete_all
+      else
+        return forbidden
+      end
+      head :no_content
+    end
+
+    private
+
+    def load_document
+      @doc = Document.find(params[:id])
+      @role = @doc.role_for(user: Current.user, token: share_token)
+      raise ActiveRecord::RecordNotFound unless @role # 404, not 403: don't confirm it exists
+    end
+
+    def content_param
+      c = params.require(:content)
+      c.is_a?(String) ? c : c.to_unsafe_h.to_json
+    end
+
+    def touch_membership
+      return unless Current.user
+      @doc.document_memberships.where(user: Current.user).update_all(last_opened_at: Time.current)
+    end
+
+    def forbidden = render(json: { error: "forbidden" }, status: :forbidden)
+  end
+end