refactor(notes): remove legacy whole-document saves; all block changes go through sync

Phase 5 of the collaboration plan:
- Remove PATCH /documents/{id}/blocks, PatchDocumentBlocks, the
  DOC_BLOCKS_PATCHED event and its types, FlushDocumentState and
  LoadDocumentState. PUT /documents/{id} rejects blocks (400) and only
  changes title, icon, folder and pin; editors may now change title/icon.
- The to-do overview ticks via a single operation on /docs/{id}/sync
  (new skipLog flag). Task links set the block tick with a targeted
  operation and notify open editors; creating a linked task needs edit
  rights.
- Keep the three share tables: DocRole already decides centrally, and
  rewriting the visibility queries would only add risk (documented in plan).
- Tests adapted to the new paths; share e2e test now also ticks a to-do in
  the overview.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/api/server_test.go

@@ -13,6 +13,7 @@ import (
 	"time"
 
 	"github.com/sandrodach/mindsift/internal/auth"
+	"github.com/sandrodach/mindsift/internal/collab"
 	"github.com/sandrodach/mindsift/internal/config"
 	"github.com/sandrodach/mindsift/internal/domain"
 	"github.com/sandrodach/mindsift/internal/storage"
@@ -1269,17 +1270,30 @@ func TestDocumentSharingStrictlyReadOnly(t *testing.T) {
 		t.Fatalf("expected error for User B updating document, got 200 OK")
 	}
 
-	// 3. User B tries to patch document blocks -> must fail (not owner)
-	patchBody, _ := json.Marshal(domain.DocBlocksPatchRequest{
-		Upserted: []domain.DocumentBlock{{ID: "b2", Content: "Hacked by User B"}},
+	// 3. User B tries to change blocks through the sync API -> must fail (read-only)
+	hacked := "Hacked by User B"
+	syncBody, _ := json.Marshal(map[string]interface{}{
+		"clientId": "tab-b",
+		"ops":      []collab.Op{{OpID: "b-hack", Kind: collab.OpSetContent, BlockID: "b2", BaseVersion: 1, Content: &hacked}},
 	})
-	req = httptest.NewRequest(http.MethodPatch, "/api/v1/documents/"+doc.ID+"/blocks", bytes.NewReader(patchBody))
+	req = httptest.NewRequest(http.MethodPost, "/api/v1/docs/"+doc.ID+"/sync", bytes.NewReader(syncBody))
 	req.Header.Set("Authorization", "Bearer "+tokenB)
 	req.Header.Set("Content-Type", "application/json")
 	rec = httptest.NewRecorder()
 	router.ServeHTTP(rec, req)
-	if rec.Code == http.StatusOK {
-		t.Fatalf("expected error for User B patching document blocks, got 200 OK")
+	if rec.Code != http.StatusForbidden {
+		t.Fatalf("expected 403 for User B changing blocks, got %d", rec.Code)
+	}
+
+	// The old whole-document save no longer accepts blocks, not even from the owner
+	blocksBody, _ := json.Marshal(map[string]interface{}{"blocks": []domain.DocumentBlock{{ID: "b1", Content: "x"}}})
+	req = httptest.NewRequest(http.MethodPut, "/api/v1/documents/"+doc.ID, bytes.NewReader(blocksBody))
+	req.Header.Set("Authorization", "Bearer "+tokenA)
+	req.Header.Set("Content-Type", "application/json")
+	rec = httptest.NewRecorder()
+	router.ServeHTTP(rec, req)
+	if rec.Code != http.StatusBadRequest {
+		t.Fatalf("expected 400 for blocks via PUT, got %d", rec.Code)
 	}
 
 	// 4. User A (owner) can successfully update document