feat(page-data): complete Phase 4-5, ops UI, and publish integration

Add visitor roles, row-level scope, owner ops APIs, MySQL policy index,
Turnstile captcha, browser client SDK, publish-panel dataset binding,
acceptance tests, and usage documentation.

Co-authored-by: Cursor <cursoragent@cursor.com>

page-data-publish-sync.mjs

@@ -0,0 +1,24 @@
+import { readPageAccessPolicy, writePageAccessPolicy } from './page-data-policy-store.mjs';
+
+const PAGE_DATA_ACCESS_MODES = new Set(['public', 'password', 'login_required']);
+
+export function mapPublicationAccessModeToPageData(accessMode) {
+  const mode = String(accessMode ?? '').trim();
+  if (PAGE_DATA_ACCESS_MODES.has(mode)) return mode;
+  return null;
+}
+
+export function syncPageDataPolicyAccessMode(workspaceRoot, pageId, publicationAccessMode, ownerUserId) {
+  const mapped = mapPublicationAccessModeToPageData(publicationAccessMode);
+  if (!mapped) return null;
+  const policy = readPageAccessPolicy(workspaceRoot, pageId);
+  if (!policy) return null;
+  if (policy.ownerUserId !== ownerUserId) return null;
+  if (policy.accessMode === mapped) return policy;
+  return writePageAccessPolicy(workspaceRoot, {
+    ...policy,
+    pageId,
+    ownerUserId,
+    accessMode: mapped,
+  });
+}