feat: F5.2 sign-in with the dashboard's ticket and the service way

Server F checks the dashboard's entry ticket as itsdangerous does
(tools/ticket-oracle: tickets made by itsdangerous 2.2.0 itself), redeems
it at /__auth for a session cookie (only the key's SHA-256 is kept) and
decides at /sync by the session's grant: none, read or write; a frozen
project is read by everyone; every refusal names its reason (one list in
packages/protocol/src/sync.ts). A WebSocket from a page of another origin
is refused. /svc/* with the service key makes, deletes, freezes and
thaws projects, ends a person's grant or all their sessions (connections
let go) and lists the sessions. Snapshots, restoring and copying move to
F6 (they need the canonical doc.json and an epoch).

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

packages/server/src/persistence.ts

@@ -4,7 +4,8 @@
 // service asks (a minute after the last change, and when the last person
 // leaves; plan §5.4). A compaction stores the document as it is and drops
 // the updates stored before it; one stored after it stays, and applying it
-// again on loading changes nothing (Yjs).
+// again on loading changes nothing (Yjs). A project being deleted is
+// discarded: what is still asked for is not stored any more.
 
 import * as Y from 'yjs';
 import { errorText, type Log } from './log.js';
@@ -21,6 +22,7 @@ export class DocumentPersistence {
   private sinceCompaction = 0;
   /** Updates queued since the last compaction was queued: what decides the next one. */
   private queued = 0;
+  private discarded = false;
 
   constructor(
     private readonly store: DocStore,
@@ -47,7 +49,7 @@ export class DocumentPersistence {
   }
 
   private enqueue(work: () => Promise<void>): Promise<void> {
-    this.queue = this.queue.then(work).catch((error: unknown) => this.log.error('store.failed', { project: this.project, error: errorText(error) }));
+    this.queue = this.queue.then(() => (this.discarded ? undefined : work())).catch((error: unknown) => this.log.error('store.failed', { project: this.project, error: errorText(error) }));
     return this.queue;
   }
 
@@ -73,6 +75,12 @@ export class DocumentPersistence {
     });
   }
 
+  /** Nothing stored any more; done once what is being stored now is. */
+  discard(): Promise<void> {
+    this.discarded = true;
+    return this.flush();
+  }
+
   /** Everything stored that was asked for. */
   flush(): Promise<void> {
     return this.enqueue(async () => {});