feat(page-data): complete Phase 4-5, ops UI, and publish integration

Add visitor roles, row-level scope, owner ops APIs, MySQL policy index,
Turnstile captcha, browser client SDK, publish-panel dataset binding,
acceptance tests, and usage documentation.

Co-authored-by: Cursor <cursoragent@cursor.com>

page-data-session-store.test.mjs

@@ -0,0 +1,13 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+import { createPageDataSessionStore } from './page-data-session-store.mjs';
+
+test('session store revokeByPageId and listByPageId work per page', () => {
+  const store = createPageDataSessionStore({ ttlMs: 60_000 });
+  const a = store.issue({ pageId: 'page-a', ownerUserId: 'owner-1', publicationId: 'pub-a', accessMode: 'password' });
+  const b = store.issue({ pageId: 'page-b', ownerUserId: 'owner-1', publicationId: 'pub-b', accessMode: 'password' });
+  assert.equal(store.listByPageId('page-a').length, 1);
+  assert.equal(store.revokeByPageId('page-a'), 1);
+  assert.equal(store.verify(a.token), null);
+  assert.ok(store.verify(b.token));
+});