Add trust features: history, trash, export, and collection sharing

Implement Notion-like upgrade phase 4: append-only page revisions with restore-as-a-new-version; recoverable bookmark/page/collection deletions whose restores never resurrect public flags or shares; owner-scoped JSON export; and explicit, revocable read-only collection sharing with owner-only mutations and no transitive third-party bookmark leaks. Add migration 009, API/docs, integration coverage, and page/collections/trash UI.

PLAN.md

@@ -80,9 +80,6 @@ keeping its own passwords.*
 
 **Product features**
 
-- Collections can't be shared — they're private to their owner.
-- No page history (can't see or restore older versions).
-- No trash — deletes are permanent.
 - Calendar and list views for collections are stored but still display as
   tables.
 - Alerts only show inside the app — nothing is emailed or pushed to you.
@@ -168,15 +165,18 @@ maintenance rather than a separate milestone.
 
 ### 3–6 months: grow the product
 
-- **Page history and trash** — see old versions, restore them; deleted
-  things are recoverable.
+- **Page history and trash** — done: versioned history with restore, and
+  recoverable bookmark/page/collection deletes. Restores never resurrect a
+  revoked share or public link.
 - **Nested pages and backlinks** — done: a real page tree, "what links here"
   that never shows titles you're not allowed to see, and live collection
   views embedded in pages.
-- **Collection sharing** — the big one. Explicit, shown in the UI, and
-  revocable. Design the permission rules first (a project must never
-  accidentally widen who can see a bookmark), then build it. Once it
-  exists, cross-project "relation" columns can follow.
+- **Collection sharing** — done: explicit, disclosed, revocable read-only
+  shares; recipients see the narrowed bookmark view, and removing an item or
+  revoking access removes it immediately. Cross-project "relation" columns
+  can follow.
+- **Structured export** — done: an owner-scoped JSON archive richer than the
+  per-item Markdown downloads.
 - **Alerts that reach you** — email or webhook when a due date hits or an
   email watcher matches. Turns the app from a dashboard into a notifier.
 - **RSS watchers** — "tell me when this feed mentions X." Reuses everything