Add Rails backend: accounts via magic link, server documents, sharing

The app becomes a Rails 8 application; the Vue frontend moves to
app/frontend and is served through vite_rails.

- Without an account documents stay in the browser (IndexedDB). Sign-in
  is by magic link or the 6-digit code from the same mail; afterwards
  local documents can be uploaded into the account.
- Server documents (/d/<id>) with versioned saves and a single-editor
  lock per browser tab; others see them read-only and follow by polling.
- Sharing via link (works without an account) and via e-mail invitation,
  roles viewer/editor; the owner manages links and people.
- Store gains a read-only mode that blocks all content changes.
- Solid Queue, Cache and Cable share the one PostgreSQL database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/controllers/api/shares_controller.rb

@@ -0,0 +1,74 @@
+module Api
+  # Everything about who has access to a document. Owner only.
+  class SharesController < BaseController
+    before_action :require_authentication
+    before_action :load_owned_document
+
+    # GET /api/documents/:document_id/share
+    def show
+      render json: share_json
+    end
+
+    # POST /api/documents/:document_id/share/links { role }
+    # One active link per role: creating one replaces (revokes) the previous.
+    def create_link
+      role = params.require(:role)
+      return render(json: { error: "invalid_role" }, status: :unprocessable_entity) unless ShareLink.roles.key?(role)
+      @doc.transaction do
+        @doc.share_links.active.where(role:).find_each(&:revoke!)
+        @doc.share_links.create!(role:, created_by: Current.user)
+      end
+      render json: share_json
+    end
+
+    # DELETE /api/documents/:document_id/share/links/:id
+    def revoke_link
+      @doc.share_links.active.find(params[:id]).revoke!
+      render json: share_json
+    end
+
+    # POST /api/documents/:document_id/share/invitations { email, role }
+    def invite
+      role = params.require(:role)
+      return render(json: { error: "invalid_role" }, status: :unprocessable_entity) unless MagicLink.roles.key?(role)
+      link = MagicLink.issue!(email: params.require(:email), purpose: :invitation, document: @doc, role:, invited_by: Current.user)
+      if link.email == Current.user.email
+        link.destroy!
+        return render(json: { error: "self_invite" }, status: :unprocessable_entity)
+      end
+      AuthMailer.invitation(link, link.token).deliver_later
+      render json: share_json
+    end
+
+    # PATCH /api/documents/:document_id/share/members/:user_id { role }
+    def update_member
+      m = @doc.document_memberships.find_by!(user_id: params[:user_id])
+      m.update!(role: params.require(:role))
+      render json: share_json
+    end
+
+    # DELETE /api/documents/:document_id/share/members/:user_id
+    def remove_member
+      @doc.document_memberships.where(user_id: params[:user_id]).delete_all
+      render json: share_json
+    end
+
+    private
+
+    def load_owned_document
+      @doc = Current.user.owned_documents.find(params[:document_id])
+    end
+
+    def share_json
+      {
+        links: @doc.share_links.active.order(:created_at).map(&:as_json),
+        members: @doc.document_memberships.includes(:user).order(:created_at).map do |m|
+          { user_id: m.user_id, name: m.user.name, email: m.user.email, role: m.role, source: m.source }
+        end,
+        invitations: MagicLink.usable.invitation.where(document: @doc).order(:created_at).map do |i|
+          { email: i.email, role: i.role, expires_at: i.expires_at.iso8601 }
+        end
+      }
+    end
+  end
+end