feat: comments, notifications, role-binding authorization

[xiongxz]

Full snapshot of the private repository at bade87e, bringing the public tree level with it. 26 private pull requests since the 0.2.0 snapshot; #159, #161 and #165 were already cherry-picked here and are unchanged by this sync.

What it carries

• Comments, productised (#163, #166–#172, #174, #178, #179): select text in an HTML or PDF artifact and comment on the selection; rich text and private image attachments; search within authorized discussions; @mentions with a permission-aware picker; record which version addresses a discussion; agent-facing feedback context and result attribution.
• Notifications (#177): a personal in-app inbox for replies to followed discussions, automatic follows for authors and repliers, persistent unfollows, and retention settings.
• Authorization on database role bindings (#157, #160): permissions, roles, role_permissions and role_bindings replace hard-coded runtime roles and legacy records; retired storage and the redundant collaborator/edit-policy interface are removed. Migrations 0007–0009 plus a bootstrap step. Deploy with a coordinated restart — old and new authorization writers must not run together (see docs/RBAC.md).
• Version uploads from the browser (#173): upload a new version of an existing site, folder/ZIP or document from the library, viewer menu or version history.
• Navigation and performance (#162, #175, #176, #180, #183, #185): no per-row permission waterfall in My sites, progressive preview loading, native same-document fragment activation inside hosted artifacts, action menus clamped to the viewport.
• Sharing and account navigation (#182, #186, #187): quick share links, private-site guidance scoped per account and site, a mobile bottom sheet with focus trapping, view history as a peer tab beside share links and people.
• Public pages (#184): Open Graph and Twitter metadata for home, Explore and the agent guide, robots.txt and a marketing-only sitemap.xml, localized quota guidance. Artifact pages keep their policy-aware cards and stay out of search results.
• Other fixes: upload receipts preserved under concurrent PUTs (#165, already here), users preserved across OIDC subject changes (#181).

Four new migrations (0010 comment attachments, 0011 comment results, 0012 notifications, 0013 comment mentions) and two new settings documented in .env.example and SELFHOST.md. Nothing hard-codes a hosted domain; metadata, robots and sitemap all derive from the deployment's own public URL.

Verified locally on this branch

npm ci (root and cli/), tsc --noEmit, eslint ., vitest run (165 files, 1874 tests passed, 23 files skipped), cli tests, and next build — all green. The export excludes docs/internal, deployment kit files and the sync script, as before.

Suggested follow-up: tag v0.3.0 after merge.

🤖 Generated with Claude Code