Merge NEXT: planning, generation map and portable configuration on top of the OIDC access model

NEXT predates the access work, so the identity layer follows master: access comes from
configured groups, instance administrators replace the site administration, and accounts are
created by SSO or by an administrator. Kept from NEXT: manual publication with the Review
changes panel and shared generator drafts, portable import/export (meguri/v2), the layered
generation map with binding provenance, JSM provider changes, contact/approval semantics and
the account-owned Person. Dropped: site administration, local sign-up, and the mandatory
unique email with its contact/account migrations. The manual-publication migration is
renumbered m_0010 after m_0009_access.

Accounts without an email still get a Person in every workspace they reach, a changed sign-in
email updates the account's person, and an account that loses access keeps its linked person so
schedules stay valid. Instance administrators may use Sync and shared drafts.

Co-Authored-By: Claude <noreply@anthropic.com>

src/models.rs

@@ -96,6 +96,9 @@ pub struct AuditRow {
 #[derive(Debug, Clone)]
 #[model(table_name = "sync_jobs")]
 pub struct SyncJobRow {
+    pub authorized_revision: Option<i64>,
+    pub authorized_document: Option<String>,
+    pub published_document: Option<String>,
     #[model(primary_key)]
     pub workspace_id: String,
     pub requested_revision: i64,
@@ -140,6 +143,15 @@ pub struct InstanceStateRow {
     pub value: String,
 }
 
+#[derive(Debug, Clone)]
+#[model(table_name = "workspace_drafts")]
+pub struct WorkspaceDraftRow {
+    #[model(primary_key)]
+    pub workspace_id: String,
+    pub revision: i64,
+    pub payload: String,
+}
+
 #[derive(Debug, Clone)]
 #[model(table_name = "instance_audit")]
 pub struct InstanceAuditRow {