Add read-only sharing, API tokens and OpenAPI spec

- Share a note as a live read-only page at /s/{token} with optional password and expiry
- Share page renders with the shared parser (TOC, footnotes, math, Mermaid, code highlighting)
  and only serves images from the note's own .assets directory
- Shares follow renames made through the API or externally
- Manage shares and API tokens from the command palette and file tree
- Accept read/write API tokens as Bearer credentials; management endpoints require a session
- Serve a hand-written openapi.json, checked against the route table in tests

web/vite.config.ts

@@ -2,11 +2,23 @@ import vue from '@vitejs/plugin-vue'
 import { defineConfig } from 'vitest/config'
 
 export default defineConfig({
-  plugins: [vue()],
+  plugins: [
+    vue(),
+    // 开发服务器中把分享地址 /s/{token} 交给分享页入口（生产环境由 Go 服务处理）
+    {
+      name: 'rawmark-share-route',
+      configureServer(server) {
+        server.middlewares.use((req, _res, next) => {
+          if (req.url?.startsWith('/s/')) req.url = '/share.html'
+          next()
+        })
+      },
+    },
+  ],
   build: {
     rolldownOptions: {
-      // demo.html 为免登录的编辑器演示页，供自动化性能/交互测试使用
-      input: { index: 'index.html', demo: 'demo.html' },
+      // demo.html 为免登录的编辑器演示页，供自动化性能/交互测试使用；share.html 为只读分享页（/s/{token}）
+      input: { index: 'index.html', demo: 'demo.html', share: 'share.html' },
     },
   },
   worker: { format: 'es' },