Add trust features: history, trash, export, and collection sharing

Implement Notion-like upgrade phase 4: append-only page revisions with restore-as-a-new-version; recoverable bookmark/page/collection deletions whose restores never resurrect public flags or shares; owner-scoped JSON export; and explicit, revocable read-only collection sharing with owner-only mutations and no transitive third-party bookmark leaks. Add migration 009, API/docs, integration coverage, and page/collections/trash UI.

web/computer_porting_guide.md

@@ -96,6 +96,12 @@ Composite PK (`sourcePageId`, `targetPageId`), `createdAt`; both Cascade, with a
 ### 2.13c `PageEmbed` (live collection view inside a page)
 Composite PK (`pageId`, `collectionId`), `viewId?` → CollectionView (SetNull), `position` int, `createdAt`; page and collection Cascade. Rebuilt from `{{collection:<id>|view=<viewId>}}` on every content save; only owned collections are stored. Item reads still go through the collection endpoint, so an embed displays, never publishes.
 
+### 2.13d `PageRevision` (server-side page history)
+`id`, `pageId` → Page (Cascade), `version` int, `title`, `content`, `icon?`, `createdAt`; unique (`pageId`, `version`). Every committed content version is snapshotted. Restoring a revision copies it into the live page as a **new** version and records that restore.
+
+### 2.13e `Trash` (recoverable deletions)
+`id`, `ownerId` → User (Cascade), `type` (`bookmark`/`page`/`collection`), `originalId`, `data` jsonb snapshot, `deletedAt`; unique (`type`, `originalId`). Snapshots restore intrinsic content and owner-scoped links, but never access grants (public flags, bookmark/tag/collection shares).
+
 ### 2.14 `SignalSource` (a watcher attached to a bookmark)
 `id`, `type` (e.g. `email`), `config` (JSON, default `{}`), `enabled` (default true), `lastCheckedAt?`, `lastStatus?`, `bookmarkId` → Bookmark (Cascade), `ownerId` → User (Cascade).