refactor(notes): remove legacy whole-document saves; all block changes go through sync

Phase 5 of the collaboration plan:
- Remove PATCH /documents/{id}/blocks, PatchDocumentBlocks, the
  DOC_BLOCKS_PATCHED event and its types, FlushDocumentState and
  LoadDocumentState. PUT /documents/{id} rejects blocks (400) and only
  changes title, icon, folder and pin; editors may now change title/icon.
- The to-do overview ticks via a single operation on /docs/{id}/sync
  (new skipLog flag). Task links set the block tick with a targeted
  operation and notify open editors; creating a linked task needs edit
  rights.
- Keep the three share tables: DocRole already decides centrally, and
  rewriting the visibility queries would only add risk (documented in plan).
- Tests adapted to the new paths; share e2e test now also ticks a to-do in
  the overview.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

frontend/src/lib/api.ts

@@ -595,11 +595,10 @@ export const api = {
       title?: string;
       icon?: string;
       folderPath?: string;
-      blocks?: DocumentBlock[];
-      tags?: string[];
       isPinned?: boolean;
     }
   ): Promise<Document> {
+    // Block content is saved through the note sync engine (lib/docSync), not here
     const d = await request<Document>(`/api/v1/documents/${id}`, {
       method: 'PUT',
       body: JSON.stringify(patch),
@@ -611,25 +610,6 @@ export const api = {
     };
   },
 
-  async patchDocumentBlocks(
-    id: string,
-    payload: {
-      upserted?: DocumentBlock[];
-      deletedIds?: string[];
-      blockOrder?: string[];
-    }
-  ): Promise<Document> {
-    const d = await request<Document>(`/api/v1/documents/${id}/blocks`, {
-      method: 'PATCH',
-      body: JSON.stringify(payload),
-    });
-    return {
-      ...d,
-      blocks: ensureArray(d.blocks),
-      tags: ensureArray(d.tags),
-    };
-  },
-
   async joinSSERoom(sseId: string, room: string, action: 'join' | 'leave' = 'join'): Promise<{ success: boolean }> {
     return request<{ success: boolean }>('/api/v1/events/rooms', {
       method: 'POST',