feat: Phase 11 — CRUD (create/update/delete) + auth + web UI

- Core: createDocument/updateDocument/deleteDocument (file + DB + revision + chunks)
- Parser: stringifyFile (serialize markdown with frontmatter to disk)
- API: tRPC CRUD routers (auth-gated via requireWriteAuth middleware)
- API: createContext now passes expectedSecret from deps (request-scoped auth)
- MCP: 3 new write tools (create_document, update_document, delete_document)
- Web: /create page + ?edit=1 form, /api/auth/login (cookie-based), /api/docs REST CRUD
- Web: Edit buttons on homepage + doc pages (auth-gated)
- Tests: 8 new tests (5 tRPC CRUD + 3 MCP CRUD auth), 40 total all green

apps/api/src/router.ts

@@ -10,20 +10,22 @@ import {
   listRevisions,
   getRevision,
   restoreRevision,
+  createDocument,
+  updateDocument,
+  deleteDocument,
 } from "@mcpedia/core";
 import { getQueue, INDEX_QUEUE } from "@mcpedia/queue";
 import { getConnection, BULLMQ_PREFIX } from "@mcpedia/queue/client";
-import { WEBHOOK_SECRET } from "@mcpedia/config";
 
 // restoreRevision is a state-changing action (it rewrites the live document row
 // + rebuilds its chunks). It must NOT be callable anonymously over the network —
 // only the Web UI (which calls @mcpedia/core directly) and an operator with the
 // webhook secret may use it. Anything else is rejected.
 const requireWriteAuth = t.middleware(({ ctx, next }) => {
-  if (!WEBHOOK_SECRET) {
+  if (!ctx.expectedSecret) {
     throw new Error("WEBHOOK_SECRET is not configured; writes are disabled");
   }
-  if (ctx.webhookSecret !== WEBHOOK_SECRET) {
+  if (ctx.webhookSecret !== ctx.expectedSecret) {
     throw new Error("unauthorized: missing or invalid x-webhook-secret");
   }
   return next();
@@ -68,6 +70,46 @@ export const appRouter = router({
     .input(z.object({ id: z.string() }))
     .mutation(async ({ input }) => restoreRevision(input.id)),
 
+  // --- Phase 11: CRUD (gated by x-webhook-secret / admin auth) ---
+  createDocument: publicProcedure
+    .use(requireWriteAuth)
+    .input(
+      z.object({
+        slug: z.string().min(1),
+        title: z.string().min(1),
+        section: z.enum(["docs", "writeups", "research", "notes"]),
+        body: z.string(),
+        type: z.enum(["documentation", "writeup", "research", "note"]).optional(),
+        status: z.enum(["published", "draft"]).optional(),
+        author: z.string().optional(),
+        tags: z.array(z.string()).optional(),
+      }),
+    )
+    .mutation(async ({ input }) => createDocument(input)),
+
+  updateDocument: publicProcedure
+    .use(requireWriteAuth)
+    .input(
+      z.object({
+        slug: z.string().min(1),
+        title: z.string().min(1).optional(),
+        body: z.string().optional(),
+        type: z.enum(["documentation", "writeup", "research", "note"]).optional(),
+        status: z.enum(["published", "draft"]).optional(),
+        tags: z.array(z.string()).optional(),
+        author: z.string().optional(),
+      }),
+    )
+    .mutation(async ({ input }) => {
+      const { slug, ...rest } = input;
+      return updateDocument(slug, rest);
+    }),
+
+  deleteDocument: publicProcedure
+    .use(requireWriteAuth)
+    .input(z.object({ slug: z.string().min(1) }))
+    .mutation(async ({ input }) => deleteDocument(input.slug)),
+
   // --- Phase 3: async job status ---
   jobStatus: publicProcedure
     .input(z.object({ id: z.string() }))