feat: Phase 11 — CRUD (create/update/delete) + auth + web UI

- Core: createDocument/updateDocument/deleteDocument (file + DB + revision + chunks)
- Parser: stringifyFile (serialize markdown with frontmatter to disk)
- API: tRPC CRUD routers (auth-gated via requireWriteAuth middleware)
- API: createContext now passes expectedSecret from deps (request-scoped auth)
- MCP: 3 new write tools (create_document, update_document, delete_document)
- Web: /create page + ?edit=1 form, /api/auth/login (cookie-based), /api/docs REST CRUD
- Web: Edit buttons on homepage + doc pages (auth-gated)
- Tests: 8 new tests (5 tRPC CRUD + 3 MCP CRUD auth), 40 total all green

apps/web/app/create/page.tsx

@@ -0,0 +1,37 @@
+import { WEBHOOK_SECRET } from "@mcpedia/config";
+import { cookies } from "next/headers";
+import DocForm from "@/components/DocForm";
+import Link from "next/link";
+
+// GET /create — show the document creation form.
+// Auth: requires the mcpedia_admin cookie (set via /api/auth/login).
+export const dynamic = "force-dynamic";
+
+export default async function CreateDocPage() {
+  const cookieStore = await cookies();
+  const canEdit = cookieStore.get("mcpedia_admin")?.value != null;
+
+  if (!canEdit) {
+    return (
+      <div className="p-8 max-w-md mx-auto">
+        <h1 className="text-xl font-semibold mb-4">Authentication required</h1>
+        <p className="text-zinc-600 dark:text-zinc-400 mb-4">
+          You must be logged in to create documents.
+        </p>
+        <Link
+          href="/login"
+          className="px-4 py-2 bg-zinc-900 dark:bg-zinc-100 text-white dark:text-zinc-900 rounded"
+        >
+          Login
+        </Link>
+      </div>
+    );
+  }
+
+  return (
+    <div className="p-8">
+      <h1 className="text-2xl font-bold mb-6">Create Document</h1>
+      <DocForm mode="create" slug="" secret={WEBHOOK_SECRET} />
+    </div>
+  );
+}