feat(page-data): complete Phase 4-5, ops UI, and publish integration

Add visitor roles, row-level scope, owner ops APIs, MySQL policy index,
Turnstile captcha, browser client SDK, publish-panel dataset binding,
acceptance tests, and usage documentation.

Co-authored-by: Cursor <cursoragent@cursor.com>

schema.sql

@@ -250,6 +250,17 @@ CREATE TABLE IF NOT EXISTS h5_publish_records (
   CONSTRAINT fk_h5_publish_scan FOREIGN KEY (security_scan_id) REFERENCES h5_security_scans(id) ON DELETE CASCADE
 ) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
 
+CREATE TABLE IF NOT EXISTS h5_page_data_policy_index (
+  page_id CHAR(36) PRIMARY KEY,
+  owner_user_id CHAR(36) NOT NULL,
+  access_mode VARCHAR(32) NOT NULL,
+  dataset_count INT UNSIGNED NOT NULL DEFAULT 0,
+  scope_hash CHAR(16) NOT NULL,
+  updated_at BIGINT NOT NULL,
+  KEY idx_h5_page_data_policy_owner (owner_user_id, updated_at),
+  CONSTRAINT fk_h5_page_data_policy_owner FOREIGN KEY (owner_user_id) REFERENCES h5_users(id) ON DELETE CASCADE
+) ENGINE=InnoDB DEFAULT CHARSET=utf8mb4 COLLATE=utf8mb4_unicode_ci;
+
 CREATE TABLE IF NOT EXISTS h5_publication_asset_refs (
   publication_id CHAR(36) NOT NULL,
   asset_id CHAR(36) NOT NULL,