feat(sync): scaffold monorepo, extract docmost-client, add Phase-0 harness + read-only pull

Lock the access-layer decision (REST only) and start implementation per SPEC.

- monorepo (npm workspaces): packages/docmost-client = DocmostClient + lib/*
  copied 1:1 from docmost-mcp/src (backport target), plus bannered sync methods
  (listTrash, restorePage, listAllSpacePages, exportPageBody, listRecentSince /
  collectRecentSince cursor scan)
- engine stays the root app per AGENTS.md (src/, test/, build/, data/, settings.ts);
  add roundtrip.ts (SPEC §11 idempotency harness), pull.ts (SPEC §6 read-only
  Docmost->FS mirror), sanitize.ts (SPEC §12 filenames, path-traversal-safe)
- Dockerfile builds the workspace lib before the app; vitest gates CI
- exportPageBody never touches /comments (SPEC §3); serializeDocmostMarkdownBody
  emits meta + body only
- SPEC: resolve access-layer (REST), reflect root-engine layout + REST pagination
- tests: sanitize (incl. dot-traversal), collectRecentSince (cutoff/dedup/cap),
  stripBlockIds, markdown round-trip byte-stability

Note: raw ProseMirror round-trip is byte-stable in Markdown but not yet attribute-
idempotent (SPEC §11 Задача №0, before Phase 2).

AGENTS.md

@@ -14,6 +14,13 @@ and the phased plan before adding engine logic.
 
 ## Project structure
 
+The project is now an **npm-workspaces monorepo**. `packages/docmost-client` is
+the extracted `DocmostClient` + `lib/` — a verbatim 1:1 copy of `docmost-mcp/src/`
+with the sync-specific methods appended under a clear banner (changes are
+backported into `docmost-mcp` manually). The **ROOT remains the engine app**
+(`src/`, `test/`, `build/`, `data/`) and depends on `docmost-client`. `npm run
+build` builds the lib first, then compiles the app to `build/`.
+
 - `src/` — application code.
   - `src/settings.ts` — the single config entry point (zod schema keyed by the
     real ENV var names; `parseSettings` is pure, `loadSettings` reads `.env`).