feat(page-data): complete Phase 4-5, ops UI, and publish integration

Add visitor roles, row-level scope, owner ops APIs, MySQL policy index,
Turnstile captcha, browser client SDK, publish-panel dataset binding,
acceptance tests, and usage documentation.

Co-authored-by: Cursor <cursoragent@cursor.com>

page-access-policy.test.mjs

@@ -2,6 +2,7 @@ import assert from 'node:assert/strict';
 import test from 'node:test';
 import {
   buildEffectiveDataset,
+  closePolicyDataset,
   normalizePageAccessPolicy,
   policyAllowsAction,
 } from './page-access-policy.mjs';
@@ -65,3 +66,17 @@ test('policyAllowsAction respects per-dataset flags', () => {
   assert.equal(policyAllowsAction(policy, 'ledger', 'insert'), true);
   assert.equal(policyAllowsAction(policy, 'missing', 'read'), false);
 });
+
+test('closePolicyDataset disables all dataset actions', () => {
+  const policy = normalizePageAccessPolicy({
+    pageId: 'page-1',
+    ownerUserId: 'user-1',
+    accessMode: 'password',
+    datasets: {
+      ledger: { read: true, insert: true, update: true, softDelete: true, columns: {} },
+    },
+  });
+  const closed = closePolicyDataset(policy, 'ledger');
+  assert.equal(closed.datasets.ledger.closed, true);
+  assert.equal(policyAllowsAction(closed, 'ledger', 'insert'), false);
+});