feat: advance local-first workspace checklist

- add admin access-policy UI and local access control surfaces

- add local markdown conflict resolution UI and smoke coverage

- add ACP local agent changed-files audit scaffold and read-only write guard

- document current P0-P2 checklist progress and verification evidence

rust/crates/mnote-web/src/ssr/pages/document.rs

@@ -188,6 +188,9 @@ pub fn DocumentPage(
     /// 右侧页面选项 JSON（可选）
     #[prop(optional)]
     secondary_page_options_json: String,
+    /// 是否显示管理员授权入口
+    #[prop(optional)]
+    show_admin_access_policy: bool,
 ) -> impl IntoView {
     let has_page_subtree = page_subtree_json
         .as_deref()
@@ -285,7 +288,7 @@ pub fn DocumentPage(
         visible: secondary_visible,
     };
     view! {
-        <PageLayout current_nav="documents" sidebar_tree_html={sidebar_tree_html.unwrap_or_default()} workspace_name={workspace_name.unwrap_or_default()} workspace_sidebar_html={workspace_sidebar_html.unwrap_or_default()} topbar_title={title.clone()}>
+        <PageLayout current_nav="documents" sidebar_tree_html={sidebar_tree_html.unwrap_or_default()} workspace_name={workspace_name.unwrap_or_default()} workspace_sidebar_html={workspace_sidebar_html.unwrap_or_default()} topbar_title={title.clone()} show_admin_access_policy={show_admin_access_policy}>
             <div
                 class="document-workspace"
                 data-testid="mnote-document-workspace"