Add trust features: history, trash, export, and collection sharing

Implement Notion-like upgrade phase 4: append-only page revisions with restore-as-a-new-version; recoverable bookmark/page/collection deletions whose restores never resurrect public flags or shares; owner-scoped JSON export; and explicit, revocable read-only collection sharing with owner-only mutations and no transitive third-party bookmark leaks. Add migration 009, API/docs, integration coverage, and page/collections/trash UI.

internal/handlers/bookmarks.go

@@ -363,7 +363,15 @@ func HandleBookmarksUpdate(w http.ResponseWriter, r *http.Request) {
 	respond(w, 200, v, e)
 }
 func HandleBookmarksDelete(w http.ResponseWriter, r *http.Request) {
-	e := remove(r, "Bookmark", r.PathValue("id"), "ownerId")
+	// Recoverable delete (trust phase): snapshot intrinsic fields and
+	// owner-scoped links in the same transaction as the hard delete. Shares
+	// and the public flag are deliberately not restored.
+	e := db.Transaction(r.Context(), database(r), func(tx *sql.Tx) error {
+		if e := lockUser(r, tx); e != nil {
+			return e
+		}
+		return trashBookmark(r, tx, r.PathValue("id"))
+	})
 	respond(w, 200, OK{true}, e)
 }