feat(page-data): owner CRUD, public read, and role policy UI

Expose owner PATCH/soft-delete routes, allow anonymous read/stats on
public pages when policy enables read, and add login_required role
editor to the ops panel with tests and doc updates.

Co-authored-by: Cursor <cursoragent@cursor.com>

user-data-space-service.mjs

@@ -563,6 +563,22 @@ export function createUserDataSpaceService(options = {}) {
     return { dataset, row };
   }
 
+  async function updateDatasetRow(datasetName, rowId, payload, meta = {}) {
+    const dataset = getDataset(datasetName);
+    if (!dataset) {
+      throw Object.assign(new Error('dataset 不存在'), { code: 'dataset_not_found' });
+    }
+    return updateRowForDataset(dataset, rowId, payload, meta);
+  }
+
+  async function softDeleteDatasetRow(datasetName, rowId, meta = {}) {
+    const dataset = getDataset(datasetName);
+    if (!dataset) {
+      throw Object.assign(new Error('dataset 不存在'), { code: 'dataset_not_found' });
+    }
+    return softDeleteRowForDataset(dataset, rowId, meta);
+  }
+
   async function insertDatasetRow(datasetName, payload, meta = {}) {
     const dataset = getDataset(datasetName);
     if (!dataset) {
@@ -751,7 +767,9 @@ export function createUserDataSpaceService(options = {}) {
     getStatsForDataset,
     insertDatasetRow,
     insertRowForDataset,
+    updateDatasetRow,
     updateRowForDataset,
+    softDeleteDatasetRow,
     softDeleteRowForDataset,
     restoreSoftDeletedRowForDataset,
     restoreSoftDeletedRow,