refactor(notes): remove legacy whole-document saves; all block changes go through sync

Phase 5 of the collaboration plan:
- Remove PATCH /documents/{id}/blocks, PatchDocumentBlocks, the
  DOC_BLOCKS_PATCHED event and its types, FlushDocumentState and
  LoadDocumentState. PUT /documents/{id} rejects blocks (400) and only
  changes title, icon, folder and pin; editors may now change title/icon.
- The to-do overview ticks via a single operation on /docs/{id}/sync
  (new skipLog flag). Task links set the block tick with a targeted
  operation and notify open editors; creating a linked task needs edit
  rights.
- Keep the three share tables: DocRole already decides centrally, and
  rewriting the visibility queries would only add risk (documented in plan).
- Tests adapted to the new paths; share e2e test now also ticks a to-do in
  the overview.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/server.go

@@ -159,7 +159,6 @@ func (s *Server) Router() http.Handler {
 		r.Post("/api/v1/documents", s.handleCreateDocument)
 		r.Get("/api/v1/documents/{id}", s.handleGetDocument)
 		r.Put("/api/v1/documents/{id}", s.handleUpdateDocument)
-		r.Patch("/api/v1/documents/{id}/blocks", s.handlePatchDocumentBlocks)
 		r.Put("/api/v1/documents/{id}/move", s.handleMoveDocument)
 		r.Delete("/api/v1/documents/{id}", s.handleDeleteDocument)
 		r.Post("/api/v1/documents/{id}/blocks/{blockId}/enhanced-task", s.handleCreateEnhancedTask)
@@ -903,7 +902,10 @@ func (s *Server) handleUpdateThought(w http.ResponseWriter, r *http.Request) {
 		writeStoreError(w, http.StatusBadRequest, err)
 		return
 	}
-	s.store.SyncDocBlockAndTask(userID, thoughtID, updated.IsCompleted)
+	if docID := s.store.SyncDocBlockAndTask(userID, thoughtID, updated.IsCompleted); docID != "" {
+		_, head, _ := s.store.GetDocOpsSince(docID, 0, 0)
+		s.notifyDocChanged(docID, head)
+	}
 	s.wsHub.BroadcastToUsers(append(s.taskAudience(before), s.taskAudience(updated)...), "TASK_UPDATED", updated)
 	writeJSON(w, http.StatusOK, updated)
 }
@@ -1019,59 +1021,32 @@ func (s *Server) handleUpdateDocument(w http.ResponseWriter, r *http.Request) {
 		Icon       *string                 `json:"icon"`
 		FolderPath *string                 `json:"folderPath"`
 		Blocks     *[]domain.DocumentBlock `json:"blocks"`
-		Tags       *[]string               `json:"tags"`
 		IsPinned   *bool                   `json:"isPinned"`
 	}
 	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
 		writeError(w, http.StatusBadRequest, "Ungültiges JSON")
 		return
 	}
+	if req.Blocks != nil {
+		writeError(w, http.StatusBadRequest, "Blöcke werden über POST /api/v1/docs/{id}/sync gespeichert")
+		return
+	}
 
-	doc, err := s.store.UpdateDocument(userID, docID, req.Title, req.Icon, req.FolderPath, req.Blocks, req.Tags, req.IsPinned)
+	doc, err := s.store.UpdateDocument(userID, docID, req.Title, req.Icon, req.FolderPath, req.IsPinned)
 	if err != nil {
 		writeError(w, http.StatusBadRequest, err.Error())
 		return
 	}
-	if req.Title != nil || req.Icon != nil || req.FolderPath != nil || req.Blocks != nil || req.Tags != nil {
+	if req.Title != nil {
+		_, head, _ := s.store.GetDocOpsSince(docID, 0, 0)
+		s.notifyDocChanged(docID, head)
+	}
+	if req.Title != nil || req.Icon != nil || req.FolderPath != nil {
 		s.broadcastDocToAuthorizedUsers(docID, "DOC_UPDATED")
 	}
 	writeJSON(w, http.StatusOK, doc)
 }
 
-func (s *Server) handlePatchDocumentBlocks(w http.ResponseWriter, r *http.Request) {
-	userID := auth.GetUserID(r.Context())
-	docID := chi.URLParam(r, "id")
-
-	var req domain.DocBlocksPatchRequest
-	if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
-		writeError(w, http.StatusBadRequest, "Ungültiges JSON")
-		return
-	}
-
-	doc, mergedOrder, err := s.store.PatchDocumentBlocks(userID, docID, req)
-	if err != nil {
-		writeError(w, http.StatusBadRequest, err.Error())
-		return
-	}
-
-	patchEvent := domain.DocBlocksPatchEvent{
-		DocID:      docID,
-		UpdatedBy:  userID,
-		UpdatedAt:  doc.UpdatedAt,
-		Upserted:   req.Upserted,
-		DeletedIDs: req.DeletedIDs,
-		BlockOrder: mergedOrder,
-	}
-	s.wsHub.BroadcastDocEvent(docID, "DOC_BLOCKS_PATCHED", patchEvent)
-	if users, err := s.store.GetAuthorizedDocUsers(docID); err == nil {
-		for _, uid := range users {
-			s.wsHub.BroadcastToUser(uid, "DOC_BLOCKS_PATCHED", patchEvent)
-		}
-	}
-
-	writeJSON(w, http.StatusOK, doc)
-}
-
 func (s *Server) handleDeleteDocument(w http.ResponseWriter, r *http.Request) {
 	userID := auth.GetUserID(r.Context())
 	docID := chi.URLParam(r, "id")
@@ -1106,6 +1081,8 @@ func (s *Server) handleCreateEnhancedTask(w http.ResponseWriter, r *http.Request
 		writeError(w, http.StatusBadRequest, err.Error())
 		return
 	}
+	_, head, _ := s.store.GetDocOpsSince(docID, 0, 0)
+	s.notifyDocChanged(docID, head)
 
 	s.wsHub.BroadcastToUser(userID, "TASK_CREATED", thought)
 	writeJSON(w, http.StatusCreated, thought)