feat: sync develop fixes into main

[Alimedhat000]

Summary

Squash-merge of develop (15 commits) onto main, resolving conflicts in a single pass.

Security / fixes

• Yjs as sole writer of Document.content (fix(server): make Yjs sole writer of Document.content #86)
• Scope collaboration request decisions to route document (fix(server): scope collaboration request decisions to route document #85)
• Accept email when adding collaborators (fix(collab): accept email when adding collaborators #80)
• Fix stale 'view' share link on permission switch (fix(client): stale 'view' share link when switching permission #78)
• Fix deleting shared documents (FK RESTRICT) (fix: deleting a shared document fails (FK RESTRICT) #77)
• Re-land WS authentication + exact-ID document resolution (fix(server): WS authentication + exact-ID document resolution (from main) #74)

Features / chore

• Rate-limit auth endpoints (feat(server): rate-limit auth endpoints (re-land onto develop) #79)
• Client quality passes a–f: infra, structure, rules, seams, stories, CI (client quality/docs #66–client quality/f ci #73)
• Remove leftover debug console.log calls (fix(server): remove leftover debug console.log calls #75)

Conflict resolution

Develop's side taken where it superseded main (collaborators dropdown/stories/toolbar, use-collaborators hook, document tests); pnpm-lock.yaml regenerated via pnpm install.

Validation

• pnpm lint ✓
• pnpm typecheck ✓
• pnpm build ✓
• pnpm --filter server test — 57/57 ✓