feat(editor): /trajects/:id/docs read-only docs route (stubbed; depends on #632 + #626)

[humanintheloop25]

Summary

Adds a markdown-rendered, per-traject docs view to the editor. The route renders documentation files (docs/*.md) from the corpus-sources attached to a traject, behind the usual session-auth + an upcoming explicit editor-reader role gate.

/trajects/:trajectId/docs                       → landing (sidebar only)
/trajects/:trajectId/docs/:sourceId             → source root
/trajects/:trajectId/docs/:sourceId/<path>      → specific .md page

⚠️ Stub state — blocked on #632 + #626

The backend handlers in packages/editor-api/src/traject_docs.rs currently return canned data so the frontend can be reviewed end-to-end while two upstream PRs are still in flight:

• feat: introduce traject concept for grouped law edits #632 (@tdjager) — trajects. Introduces the trajects, traject_members, accounts, and traject_corpus_sources tables. Without those we can't do the real authz check ("is this account a member of this traject?") nor list the traject's sources from the DB.
• feat(admin): layered RBAC with per-app reader/writer/admin roles #626 (@tdjager) — layered RBAC. Introduces editor-reader / editor-writer / editor-admin realm-roles. Our docs routes will be raised to editor-reader (explicit) instead of the implicit require_session_auth wired today.

Once both land, traject_docs.rs switches to:

1. Resolve session.person_sub → accounts.id via one query.
2. Assert membership in traject_members for the requested :trajectId. Not a member → 403.
3. Select traject_corpus_sources rows for the traject and walk each source's on-disk clone (the same clones feat: introduce traject concept for grouped law edits #632 uses for the writable-own flow). The docs/ subdir of each clone is the docs tree.

The handler signatures and response shapes are stable across the stub→real transition, so the frontend does not need to change when the backend is rewired.

What's in this PR

Frontend

• frontend/src/TrajectDocsApp.vue — root view (parallel to EditorApp / LibraryApp). Two-pane layout: DocsSidebar + DocsContent.
• frontend/src/components/docs/DocsSidebar.vue — lists each source attached to the traject, grouped by top-level directory.
• frontend/src/components/docs/DocsContent.vue — renders markdown via the shared useArticleMarkdown pipeline (marked + DOMPurify, identical to ArticleText.vue) and post-processes \``mermaid code blocks into SVG viamermaid.run`.
• frontend/src/composables/useDocs.js — useDocsTree + useDocsPage composables with cookie-credentialed fetches. Route-driven so refresh/back/forward keep working.
• frontend/src/router.js — new traject-docs route, meta.requiresAuth: true identical to the editor route.
• mermaid@^11.4.1 added to frontend/package.json. Lazy-loaded — only fetched when navigating to the docs route.

Backend

• packages/editor-api/src/traject_docs.rs — tree + page handlers, stub-only for now.
• packages/editor-api/src/main.rs — module registered, two routes added inside the existing protected_api_routes block (which carries require_session_auth).

Test plan

• just editor-api-fmt — clean
• just editor-api-lint (clippy) — clean
• just editor-api-check (cargo check) — clean
• cd frontend && npm run build — passes; mermaid + sub-renderers chunked separately, lazy-loaded into the TrajectDocsApp bundle
• Local interactive smoke against `just editor-api` + `cd frontend && npm run dev` — confirm `/trajects/test/docs/dummy/diagrams/fietsval-flow-2025-04-01` shows a rendered mermaid flow-chart
• After feat: introduce traject concept for grouped law edits #632 + feat(admin): layered RBAC with per-app reader/writer/admin roles #626 merge: rebase, swap canned data for real DB queries + add membership-401, add explicit editor-reader route-layer

Not in this PR (follow-ups)

• Real DB-backed handlers (blocked on feat: introduce traject concept for grouped law edits #632)
• Explicit editor-reader realm-role gate (blocked on feat(admin): layered RBAC with per-app reader/writer/admin roles #626)
• Annotations on docs pages — RFC-018 covers law-text annotations; whether to extend that pattern to free-text markdown is a separate design decision once these merges land.
• Source-cross-link resolution (relative .md → in-app router-link)
• Wiring corpus sources into the editor image's build pipeline (depends on feat: introduce traject concept for grouped law edits #632's clone-cache layout)

Background

Replaces an earlier exploration of a standalone docs platform (MinBZK/regelrecht-corpus-docs, soon to be archived) that built its own auth-proxy + DB. Integrating into the editor instead reuses auth, session-management, deploy pipeline, and now per-traject permissions from #632 — drastically less infrastructure for the same user-facing capability.

[github-actions]

Preview Deployment — editor — editor

Your changes have been deployed to a preview environment:

URL: https://editor.pr653.rig.prd1.gn2.quattro.rijksapps.nl

This deployment will be automatically cleaned up when the PR is closed.