Route shared document changes through review #272

Work

Reuse the proposal and moderation flow that memories and project instructions use. Private pages publish directly; shared and public pages go through review unless the author may moderate. Show a readable diff for long documents, not just a before/after dump.

Acceptance

• An agent without moderation rights cannot change a shared page without review.
• A stale base revision is rejected instead of overwriting a concurrent edit.
• Moving a page in the tree is reviewed like a content change when it changes who can read it.