fix(workspace): extract replaces the branch in the editor, with undo

The server only creates the new note and returns the link; the editor
swaps the branch for it as an ordinary own edit through the sync engine.
No more clash with unsent typing (conflict copies), the link shows at
once also with polling, and Strg+Z restores the branch. Undoing (toast or
Strg+Z) puts the new note into the trash via POST /extract/undo. The
sidebar gets the new note right away and opens its folder.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/restructure_test.go

@@ -41,16 +41,21 @@ func TestExtractBranchIntoOwnNote(t *testing.T) {
 	if rec.Code != http.StatusCreated {
 		t.Fatalf("extract: %d %s", rec.Code, rec.Body.String())
 	}
-	var created domain.Document
-	_ = json.Unmarshal(rec.Body.Bytes(), &created)
-	if created.Title != "Konzept: Garten" || created.FolderPath != "Arbeit" {
+	var out struct {
+		Document domain.Document
+		Link     string
+	}
+	_ = json.Unmarshal(rec.Body.Bytes(), &out)
+	created := out.Document
+	if created.Title != "Konzept: Garten" || created.FolderPath != "Arbeit" || out.Link != "[[Konzept: Garten]] #draußen" {
 		t.Fatalf("new note: %q in %q", created.Title, created.FolderPath)
 	}
 	if got := strings.Join(flatOf(t, store, uid, created.ID), "|"); got != "Beete|>Erde kaufen|Zaun" {
 		t.Fatalf("new note blocks: %s", got)
 	}
-	if got := strings.Join(flatOf(t, store, uid, src.ID), "|"); got != "[[Konzept: Garten]] #draußen|Danach" {
-		t.Fatalf("source after extract: %s", got)
+	// The server leaves the source alone; the editor replaces the branch itself
+	if got := strings.Join(flatOf(t, store, uid, src.ID), "|"); got != "- Konzept: Garten #draußen|>Beete|>>Erde kaufen|>Zaun|Danach" {
+		t.Fatalf("source must stay unchanged on the server: %s", got)
 	}
 	// Same title again: the link must stay unique
 	_, _ = store.CreateDocument(uid, "", "Projekt 2", "", "", []domain.DocumentBlock{{ID: "blk_x", Type: "bullet", Content: "Konzept: Garten", Level: 0}}, nil, false)
@@ -61,10 +66,21 @@ func TestExtractBranchIntoOwnNote(t *testing.T) {
 			p2 = d.ID
 		}
 	}
-	var second domain.Document
+	var second struct{ Document domain.Document }
 	_ = json.Unmarshal(sessionCall(router, "POST", "/api/v1/documents/"+p2+"/extract", token, `{"blockId":"blk_x"}`, "").Body.Bytes(), &second)
-	if second.Title != "Konzept: Garten (2)" {
-		t.Fatalf("duplicate title: %q", second.Title)
+	if second.Document.Title != "Konzept: Garten (2)" {
+		t.Fatalf("duplicate title: %q", second.Document.Title)
+	}
+	// Undo puts the new note into the trash; only its creator may
+	_, strangerToken := newTestUser(t, store, "fremd2@example.com")
+	if rec := sessionCall(router, "POST", "/api/v1/documents/"+created.ID+"/extract/undo", strangerToken, "", ""); rec.Code == http.StatusOK {
+		t.Fatal("stranger must not undo")
+	}
+	if rec := sessionCall(router, "POST", "/api/v1/documents/"+created.ID+"/extract/undo", token, "", ""); rec.Code != http.StatusOK {
+		t.Fatalf("undo: %d %s", rec.Code, rec.Body.String())
+	}
+	if d, _ := store.GetDocumentByID(uid, created.ID); d == nil || !d.IsArchived {
+		t.Fatal("extracted note must be in the trash after undo")
 	}
 }
 
@@ -87,8 +103,9 @@ func TestExtractInSharedNoteKeepsAccess(t *testing.T) {
 		t.Fatalf("reader must not extract: %d", rec.Code)
 	}
 	rec := sessionCall(router, "POST", "/api/v1/documents/"+src.ID+"/extract", editorToken, `{"blockId":"blk_s1"}`, "")
-	var created domain.Document
-	_ = json.Unmarshal(rec.Body.Bytes(), &created)
+	var out struct{ Document domain.Document }
+	_ = json.Unmarshal(rec.Body.Bytes(), &out)
+	created := out.Document
 	if rec.Code != http.StatusCreated {
 		t.Fatalf("editor extract: %d %s", rec.Code, rec.Body.String())
 	}