feat: Phase 11 — CRUD (create/update/delete) + auth + web UI

- Core: createDocument/updateDocument/deleteDocument (file + DB + revision + chunks)
- Parser: stringifyFile (serialize markdown with frontmatter to disk)
- API: tRPC CRUD routers (auth-gated via requireWriteAuth middleware)
- API: createContext now passes expectedSecret from deps (request-scoped auth)
- MCP: 3 new write tools (create_document, update_document, delete_document)
- Web: /create page + ?edit=1 form, /api/auth/login (cookie-based), /api/docs REST CRUD
- Web: Edit buttons on homepage + doc pages (auth-gated)
- Tests: 8 new tests (5 tRPC CRUD + 3 MCP CRUD auth), 40 total all green

apps/web/app/[section]/[...slug]/page.tsx

@@ -1,7 +1,10 @@
 import Link from "next/link";
 import { notFound } from "next/navigation";
-import { getDocument, listDocuments, getRelated, listRevisions } from "@mcpedia/core";
+import { cookies } from "next/headers";
+import { getDocument, getRelated, listRevisions } from "@mcpedia/core";
+import { WEBHOOK_SECRET } from "@mcpedia/config";
 import Markdown from "@/components/Markdown";
+import DocForm from "@/components/DocForm";
 
 // Render at request time. The content lives in Postgres (populated by the
 // indexer/worker), which is not available at build time (CI has no DB), so we
@@ -9,16 +12,45 @@ import Markdown from "@/components/Markdown";
 // instant.
 export const dynamic = "force-dynamic";
 
-export default async function DocPage({
-  params,
-}: {
+interface DocPageProps {
   params: Promise<{ section: string; slug: string[] }>;
-}) {
+  searchParams: Promise<{ edit?: string }>;
+}
+
+export default async function DocPage({ params, searchParams }: DocPageProps) {
   const { section, slug } = await params;
+  const { edit } = await searchParams;
   const fullSlug = `${section}/${slug.join("/")}`;
   const doc = await getDocument(fullSlug);
   if (!doc) notFound();
 
+  // Check auth for edit mode.
+  const cookieStore = await cookies();
+  const canEdit = cookieStore.get("mcpedia_admin")?.value != null;
+
+  // If ?edit=1 and authenticated → show the edit form.
+  if (edit === "1" && canEdit) {
+    return (
+      <div className="p-8">
+        <h1 className="text-2xl font-bold mb-6">Edit: {doc.title}</h1>
+        <DocForm
+          mode="edit"
+          slug={fullSlug}
+          secret={WEBHOOK_SECRET}
+          initial={{
+            title: doc.title,
+            body: doc.body,
+            section: doc.section,
+            type: doc.type,
+            status: doc.status,
+            tags: doc.tags,
+            author: doc.author,
+          }}
+        />
+      </div>
+    );
+  }
+
   const related = await getRelated(fullSlug, 5);
   const revisions = await listRevisions(fullSlug, 10);
 
@@ -34,6 +66,14 @@ export default async function DocPage({
         <div className="text-xs text-zinc-500 mt-1">
           {doc.tags.map((t) => `#${t}`).join(" ")} · {doc.author || "unknown"}
         </div>
+        {canEdit && (
+          <Link
+            href={`/${doc.slug}?edit=1`}
+            className="inline-block mt-2 px-3 py-1 text-xs border border-zinc-300 dark:border-zinc-700 rounded hover:bg-zinc-100 dark:hover:bg-zinc-800"
+          >
+            Edit
+          </Link>
+        )}
       </div>
 
       <Markdown source={doc.body} />
@@ -69,7 +109,7 @@ export default async function DocPage({
                   #{rev.revisionNo} · {rev.reason} ·{" "}
                   {new Date(rev.createdAt).toLocaleString()} · {rev.bodyLength} chars
                 </span>
-                <form action={`/api/revisions/restore/`} method="post">
+                <form action="/api/revisions/restore" method="post">
                   <input type="hidden" name="id" value={rev.id} />
                   <button
                     type="submit"