feat(page-data): owner CRUD, public read, and role policy UI

Expose owner PATCH/soft-delete routes, allow anonymous read/stats on
public pages when policy enables read, and add login_required role
editor to the ops panel with tests and doc updates.

Co-authored-by: Cursor <cursoragent@cursor.com>

page-data-public-service.mjs

@@ -209,9 +209,15 @@ export function createPageDataPublicService(deps = {}) {
   function resolveAccessContext({ publication, policy, req, action, datasetName }) {
     const accessMode = publication.access_mode;
     if (accessMode === 'public') {
-      if (action === 'read' || action === 'update' || action === 'soft_delete') {
+      if (action === 'update' || action === 'soft_delete') {
         throw Object.assign(new Error('当前页面未开放此数据操作'), { code: 'action_not_allowed' });
       }
+      if (action === 'read') {
+        if (!policyAllowsAction(policy, datasetName, 'read')) {
+          throw Object.assign(new Error('当前页面未开放此数据操作'), { code: 'action_not_allowed' });
+        }
+        return { accessMode, session: null };
+      }
       if (!policyAllowsAction(policy, datasetName, action)) {
         throw Object.assign(new Error(`dataset 未授权 ${action}`), { code: 'action_not_allowed' });
       }