refactor(collab): remove live document collaboration and enforce strictly read-only sharing

internal/storage/sqlite.go

@@ -414,6 +414,10 @@ func (s *Store) migrate() error {
 	// Backfill username for existing accounts where username is empty
 	_, _ = s.db.Exec(`UPDATE users SET username = LOWER(SUBSTR(email, 1, INSTR(email, '@') - 1)) WHERE (username IS NULL OR username = '') AND INSTR(email, '@') > 0`)
 
+	// Ensure all existing document shares are strictly read-only
+	_, _ = s.db.Exec(`UPDATE doc_shares SET permission = 'read' WHERE permission != 'read'`)
+	_, _ = s.db.Exec(`UPDATE doc_team_shares SET permission = 'read' WHERE permission != 'read'`)
+
 	// Default system settings (public registration disabled by default; invite or admin creation required)
 	_, _ = s.db.Exec(`INSERT OR IGNORE INTO system_settings (key, value) VALUES 
 		('sharing_mode', 'teams_only'),
@@ -1526,7 +1530,7 @@ func (s *Store) PatchDocumentBlocks(userID, docID string, req domain.DocBlocksPa
 	if err != nil {
 		return nil, nil, err
 	}
-	if !doc.IsOwner && doc.Permission != "write" {
+	if !doc.IsOwner {
 		return nil, nil, fmt.Errorf("keine Schreibberechtigung für dieses Dokument (nur Lesezugriff)")
 	}
 
@@ -2274,7 +2278,7 @@ func (s *Store) UpdateDocument(userID, docID string, title, icon, folderPath *st
 	isOnlyPinChange := isPinned != nil && title == nil && icon == nil && folderPath == nil && blocks == nil && tags == nil
 	isOnlyFolderMove := folderPath != nil && title == nil && icon == nil && blocks == nil && tags == nil && isPinned == nil
 
-	if !doc.IsOwner && doc.Permission != "write" && !isOnlyPinChange && !isOnlyFolderMove {
+	if !doc.IsOwner && !isOnlyPinChange && !isOnlyFolderMove {
 		return nil, fmt.Errorf("keine Schreibberechtigung für dieses Dokument (nur Lesezugriff)")
 	}
 
@@ -2908,7 +2912,7 @@ func (s *Store) MoveDocument(userID, docID, targetFolderPath string) (*domain.Do
 	// Target is NOT inside a shared folder (personal / standalone)
 	if doc.SharedFolderID != "" {
 		// Moving OUT of a shared folder into a personal folder
-		if !doc.IsOwner && doc.Permission != "write" {
+		if !doc.IsOwner {
 			return nil, fmt.Errorf("keine Berechtigung, die Notiz aus dem geteilten Ordner zu verschieben")
 		}
 		_, err = s.db.Exec(`UPDATE documents SET shared_folder_id = '', sub_folder_path = '', folder_path = ?, updated_at = ? WHERE id = ?`,
@@ -3564,8 +3568,8 @@ func (s *Store) CreateDocTeamShare(currentUserID, docID, teamID, permission stri
 	if err != nil {
 		return nil, err
 	}
-	if !doc.IsOwner && doc.Permission != "write" {
-		return nil, fmt.Errorf("nur der Eigentümer oder Bearbeiter kann Freigaben verwalten")
+	if !doc.IsOwner {
+		return nil, fmt.Errorf("nur der Eigentümer kann Freigaben verwalten")
 	}
 
 	cleanTeamID := strings.TrimSpace(teamID)
@@ -3575,9 +3579,8 @@ func (s *Store) CreateDocTeamShare(currentUserID, docID, teamID, permission stri
 		return nil, fmt.Errorf("team nicht gefunden")
 	}
 
-	if permission != "read" && permission != "write" {
-		permission = "read"
-	}
+	// Document sharing is strictly read-only
+	permission = "read"
 
 	now := domain.NowISO()
 	shareID := domain.NewID("share")
@@ -3609,20 +3612,19 @@ func (s *Store) CreateDocShare(currentUserID, docID, targetUserIdentifier, permi
 	if err != nil {
 		return nil, err
 	}
-	if !doc.IsOwner && doc.Permission != "write" {
-		return nil, fmt.Errorf("nur der Eigentümer oder Bearbeiter kann Freigaben verwalten")
+	if !doc.IsOwner {
+		return nil, fmt.Errorf("nur der Eigentümer kann Freigaben verwalten")
 	}
 
 	cleanTarget := strings.TrimSpace(targetUserIdentifier)
 
 	// If identifier looks like a team or is prefixed with team_, route to CreateDocTeamShare
 	if strings.HasPrefix(cleanTarget, "team_") {
-		return s.CreateDocTeamShare(currentUserID, docID, cleanTarget, permission)
+		return s.CreateDocTeamShare(currentUserID, docID, cleanTarget, "read")
 	}
 
-	if permission != "read" && permission != "write" {
-		permission = "read"
-	}
+	// Document sharing is strictly read-only
+	permission = "read"
 
 	// Resolve target user by ID, username, or Email
 	var targetUser *domain.User