feat(#181): collaborative editing Phases 4–6 + offline media (version history, default-on, legacy retirement, offline upload)

[important-new]

Follows up #191 (Phases 1–3, flag default-off). This makes Yjs collaborative editing the
default and only editing path, adds version history + offline media, and retires the legacy
write/offline/conflict layer. Branch base = main after #191 + #192.

What's in this PR

Phase 4 — Version history + restore (PR-D)

• Durable Object keeps periodic (every 20 edits) + on-demand JSON-projection snapshots in DO
  storage (capped 25, {seq, atMs, byUserId}), hibernation-safe (seq = max(stored)+1).
• Restore = doc-replacement (Condition B): rebuilds a fresh Y.Doc from the snapshot's
  projection (NOT Y.applyUpdate of an old state — that's a CRDT no-op); captures the current
  state first (reversible).
• Live convergence: restore broadcasts a MSG_RESTORE control frame; every connected client
  drops its local Y.Doc + IndexedDB and resyncs from scratch (a plain additive update can't revert
  deletions on a live client).
• VersionHistoryPanel editor UI (list / save-now / restore behind a custom confirm modal).

Phase 5 — Default on + retire the bespoke layer (PR-E)

• Closed a data-loss gap first: all photo/media ops now route through the Y.Doc — array ops
  (reorder/detach/move/revert) as pure doc mutations, and crop/annotate via the bake endpoints
  which skip the inspection_results.data write under collab (the DO owns that blob; the
  client mirrors the baked key into the doc). Without this, the DO's next persist() would
  silently clobber REST photo writes.
• Flipped collabEditing default ON (migration 0003 + a one-time data UPDATE for existing
  tenants) and made collab unconditional in the editor.
• Retired the per-field CAS write endpoints, the bespoke offline queue, the diff3/conflict
  services + UI (ConflictModal/LiveConflictModal/conflict-resolver), field-version.ts, and
  dropped the inspection_conflicts table (migration 0004). Yjs supersedes all of them.

Phase 6 — Wiring + docs (PR-F)

• INSPECTION_DOC Durable Object binding + v2 SQLite-class migration (see config note below).
• docs/developers/collab-editing.md (architecture, projection model, offline+multi-user merge,
  version history/restore, config) + a CLAUDE.md binding row.

PR-G — Offline media

• Offline, image content is produced client-side (canvas); only the R2 PUT needs network. A new
  CRDT-friendly media upload queue (no conflict machinery): capture offline → store the blob in
  IndexedDB + write a pending placeholder photo entry in the Y.Doc (propagates as "uploading" to
  other clients) → on reconnect, drain the queue (upload to R2, swap the doc entry pending→real key,
  an LWW update Yjs handles).
• WebSocket auto-reconnect (exponential backoff + window 'online'): offline→online now resyncs
  field data AND drains media with no page reload.
• Report/serve readers skip pending entries (no R2 object yet).

PR-H — Offline-conflict recovery (version compare + field recover)

• When two inspectors edit the SAME scalar field offline, reconnect resolves last-writer-wins and one
  value is overwritten. To make that recoverable: the DO captures a pre-merge-boundary snapshot on
  reconnect (before a client's buffered offline edits are applied; deduped, fail-open) — labeled
  "Auto-saved before a reconnect".
• The version-history panel gains a Compare action (a saved version vs current) showing field-level
  old → new diffs, with recover a single overwritten value (writes the old value back into the
  live Y.Doc → propagates + persists) or restore the whole version. UI reuses the (now-retired)
  conflict-modal's two-pane shell; no diff3/CAS logic returns.
• GET …/collab/snapshots/:seq returns a snapshot's full projection for client-side diffing.

⚠️ Deploy config (SaaS operators)

wrangler.jsonc already declares the binding + v2 migration. wrangler.saas.jsonc is gitignored,
so add this to your SaaS deploy config:

"durable_objects": { "bindings": [ /* …existing presence… */
  { "name": "INSPECTION_DOC", "class_name": "InspectionDocDO" } ] },
"migrations": [ /* …v1… */
  { "tag": "v2", "new_sqlite_classes": ["InspectionDocDO"] } ]

When env.INSPECTION_DOC is absent the collab routes return 501 and fail closed.

Migrations

• 0003_classy_maelstrom.sql — tenant_configs.collab_editing default → true + one-time
  UPDATE … SET collab_editing = 1 (flips existing tenants on).
• 0004_demonic_obadiah_stane.sql — DROP TABLE inspection_conflicts.
  (0001/0002 shipped in feat(#181): collaborative inspection editing — Yjs + Durable Objects (Phases 1–3, flag default-off) #191.)

Testing

• type-check 0/0 · db:check clean · test:unit 2145 · test:web 493 · test:workers 62 (incl multi-client,
  restore, photo-persist, MSG_RESTORE convergence, offline queue/drain, auto-reconnect, pre-merge
  snapshot, snapshot-diff) · build ✓ (bundle ~48% of the 3 MiB Workers Free limit) · lint (ds/migrefs/
  tenant-scope/filesize) OK.
• 2-client browser E2E: tests/web/e2e/collab-editing.spec.ts (both clients connect to the collab WS →
  same DO, A→B realtime propagation, reload persistence) + tests/web/e2e/collab-offline.spec.ts
  (A edits offline → B doesn't see it → A reconnects with no reload → B converges).

Closes #181 (collab editing follow-on).