feat(page-data): owner CRUD, public read, and role policy UI

Expose owner PATCH/soft-delete routes, allow anonymous read/stats on
public pages when policy enables read, and add login_required role
editor to the ops panel with tests and doc updates.

Co-authored-by: Cursor <cursoragent@cursor.com>

page-data-public-service.test.mjs

@@ -111,6 +111,19 @@ test('public page read is denied in public access mode by default', async () =>
   );
 });
 
+test('public page read works when policy explicitly enables read', async () => {
+  const workspaceRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'page-data-public-read-ok-'));
+  const ownerService = await setupPublicWorkspace(workspaceRoot, { accessMode: 'public', withRead: true });
+  await ownerService.insertRowForDataset(ownerService.getDataset('signups'), {
+    name: '公开可读',
+    phone: '13900000002',
+  });
+  const service = createPublicService(workspaceRoot, { accessMode: 'public' });
+  const rows = await service.listRows(PAGE_ID, 'signups', { headers: {} });
+  assert.equal(rows.rows.length, 1);
+  assert.equal(rows.rows[0].name, '公开可读');
+});
+
 test('login_required page read requires login and works for authenticated visitor', async () => {
   const workspaceRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'page-data-login-required-'));
   const ownerService = await setupPublicWorkspace(workspaceRoot, {