feat(page-data): complete Phase 4-5, ops UI, and publish integration

Add visitor roles, row-level scope, owner ops APIs, MySQL policy index,
Turnstile captcha, browser client SDK, publish-panel dataset binding,
acceptance tests, and usage documentation.

Co-authored-by: Cursor <cursoragent@cursor.com>

server.mjs

@@ -188,6 +188,8 @@ import { attachAsrRoutes } from './asr-proxy.mjs';
 import { attachPageDataRoutes } from './page-data-routes.mjs';
 import { createPageDataService } from './page-data-service.mjs';
 import { createPageDataPublicService, isPageDataPublicPath } from './page-data-public-service.mjs';
+import { syncPageDataPolicyAccessMode } from './page-data-publish-sync.mjs';
+import { upsertPageDataPolicyIndex } from './page-data-policy-index.mjs';
 import { isNativeH5ApiPath } from './policies.mjs';
 
 const __dirname = path.dirname(fileURLToPath(import.meta.url));
@@ -4233,6 +4235,18 @@ api.post('/mindspace/v1/pages/:pageId/publish', async (req, res) => {
         acknowledgedFindingIds: req.body?.acknowledged_finding_ids,
       },
     );
+    const workspaceRoot = req.currentUser.workspaceRoot ?? null;
+    if (workspaceRoot) {
+      const syncedPolicy = syncPageDataPolicyAccessMode(
+        workspaceRoot,
+        req.params.pageId,
+        publication.accessMode,
+        req.currentUser.id,
+      );
+      if (syncedPolicy) {
+        await upsertPageDataPolicyIndex(authPool, syncedPolicy).catch(() => null);
+      }
+    }
     await mindSpaceAudit?.write({
       userId: req.currentUser.id,
       action: 'page.publish',
@@ -5970,6 +5984,7 @@ app.use(
   express.static(path.join(__dirname, 'public/plaza-covers'), { maxAge: '7d' }),
 );
 app.use('/brand', express.static(path.join(__dirname, 'public/brand'), { maxAge: '7d' }));
+app.use('/assets', express.static(path.join(__dirname, 'public/assets'), { maxAge: '1d' }));
 
 app.get('/dev/wechat-share-preview', async (req, res) => {
   try {