Add Rails backend: accounts via magic link, server documents, sharing

The app becomes a Rails 8 application; the Vue frontend moves to
app/frontend and is served through vite_rails.

- Without an account documents stay in the browser (IndexedDB). Sign-in
  is by magic link or the 6-digit code from the same mail; afterwards
  local documents can be uploaded into the account.
- Server documents (/d/<id>) with versioned saves and a single-editor
  lock per browser tab; others see them read-only and follow by polling.
- Sharing via link (works without an account) and via e-mail invitation,
  roles viewer/editor; the owner manages links and people.
- Store gains a read-only mode that blocks all content changes.
- Solid Queue, Cache and Cable share the one PostgreSQL database.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

app/controllers/concerns/authentication.rb

@@ -0,0 +1,43 @@
+# Cookie session (signed session id), resumed on every request. Everything
+# is usable without signing in; controllers call `require_authentication`
+# where an account is needed.
+module Authentication
+  extend ActiveSupport::Concern
+
+  included do
+    before_action :resume_session
+    helper_method :signed_in?
+  end
+
+  private
+
+  def signed_in? = Current.user.present?
+
+  def resume_session
+    Current.session = Session.find_by(id: cookies.signed[:session_id]) if cookies.signed[:session_id]
+    touch_session if Current.session
+  end
+
+  def touch_session
+    s = Current.session
+    return if s.last_active_at && s.last_active_at > 1.hour.ago
+    s.update_columns(last_active_at: Time.current)
+    s.user.update_columns(last_seen_at: Time.current)
+  end
+
+  def require_authentication
+    render json: { error: "unauthenticated" }, status: :unauthorized unless signed_in?
+  end
+
+  def start_session_for(user)
+    reset_session
+    Current.session = user.sessions.create!(user_agent: request.user_agent, ip_address: request.remote_ip, last_active_at: Time.current)
+    cookies.signed.permanent[:session_id] = { value: Current.session.id, httponly: true, same_site: :lax, secure: Rails.env.production? }
+  end
+
+  def terminate_session
+    Current.session&.destroy
+    Current.session = nil
+    cookies.delete(:session_id)
+  end
+end