feat(git-sync): native GitmostDataSource + 'git-sync' provenance (Phase A.4a)

Native data plane for git-sync (plan §3, §8.1):
- provenance: widen actor to 'user'|'agent'|'git-sync' (jwt-payload,
  auth-provenance decorator); PersistenceExtension resolves lastUpdatedSource
  with precedence agent > git-sync > user, debounced history (like a human edit,
  not the agent's immediate snapshot).
- GitmostDataSourceService implements @docmost/git-sync's GitSyncClient natively:
  reads via PageRepo/SpaceRepo (listSpaceTree complete:true, getPageJson), writes
  via PageService (create/removePage soft-delete/movePage with computed fractional
  position/update-rename/restore) + the writeBody linchpin through collab
  openDirectConnection('page.'+id, {actor:'git-sync'}) mirroring
  collaboration.handler withYdocConnection 'replace'. bind({workspaceId,userId})
  returns the context-bound client for the orchestrator.
- 10 unit/contract tests (mapping + soft-delete + move-position), tsc clean.

Known gap (closed in A.4b): PageService.create/update/movePage only branch on
actor==='agent'; git-sync provenance is already passed through so the row source
marker propagates once PageService honors 'git-sync'. Module/orchestrator/config
come next.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

apps/server/src/core/auth/dto/jwt-payload.ts

@@ -18,8 +18,10 @@ export type JwtPayload = {
   // normal user token (treated as 'user'); set only when the internal agent
   // mints a provenance access token so REST writes (create/rename/move page,
   // comment create/resolve) record a non-spoofable 'agent' marker (§6.5 / §15
-  // C3 / §14 N2).
-  actor?: 'user' | 'agent';
+  // C3 / §14 N2). 'git-sync' marks writes made by the git-sync data plane
+  // (plan §8.1) — it never travels in a user-facing token; it is set in-process
+  // on the collab connection context by the native datasource.
+  actor?: 'user' | 'agent' | 'git-sync';
   aiChatId?: string;
 };
 
@@ -29,8 +31,9 @@ export type JwtCollabPayload = {
   type: 'collab';
   // Optional agent-edit provenance, signed into the collab token. Absent for
   // the human collab path (treated as 'user'); set only when the internal agent
-  // mints a provenance collab token (§6.6 / §15 C2).
-  actor?: 'user' | 'agent';
+  // mints a provenance collab token (§6.6 / §15 C2). 'git-sync' is accepted for
+  // type-compatibility with the in-process git-sync write path (plan §8.1).
+  actor?: 'user' | 'agent' | 'git-sync';
   aiChatId?: string;
 };