feat(handler): add SubmitSteps and GetSteps HTTP endpoints

cmd/server/main.go

···
 	mux.HandleFunc("GET /docs/{rkey}/accept", h.AcceptInvite)
 	mux.HandleFunc("POST /api/docs/{rkey}/comments", h.CommentCreate)
 	mux.HandleFunc("GET /api/docs/{rkey}/comments", h.CommentList)
+	mux.HandleFunc("POST /api/docs/{rkey}/steps", h.SubmitSteps)
+	mux.HandleFunc("GET /api/docs/{rkey}/steps", h.GetSteps)
 
 	// WebSocket
 	mux.HandleFunc("GET /ws/docs/{rkey}", h.CollaboratorWebSocket)

internal/handler/handler.go

···
 	}
 	return colors[hash%len(colors)]
 }
+
+// SubmitSteps receives ProseMirror steps from a collaborator, appends them
+// to the step log, and broadcasts confirmed steps to the room.
+//
+// POST /api/docs/{rkey}/steps
+// Body: {"clientVersion": N, "steps": ["...json..."], "clientID": "did:..."}
+// Response 200: {"version": N}
+// Response 409: {"version": N, "steps": ["...json..."]} — client must rebase
+func (h *Handler) SubmitSteps(w http.ResponseWriter, r *http.Request) {
+	user := h.currentUser(r)
+	if user == nil {
+		http.Error(w, "Unauthorized", http.StatusUnauthorized)
+		return
+	}
+	rkey := r.PathValue("rkey")
+
+	var body struct {
+		ClientVersion int      `json:"clientVersion"`
+		Steps         []string `json:"steps"`
+		ClientID      string   `json:"clientID"`
+	}
+	if err := json.NewDecoder(r.Body).Decode(&body); err != nil {
+		http.Error(w, "Bad request", http.StatusBadRequest)
+		return
+	}
+	if len(body.Steps) == 0 {
+		http.Error(w, "No steps", http.StatusBadRequest)
+		return
+	}
+
+	newVersion, err := h.DB.AppendSteps(rkey, body.ClientVersion, body.Steps, body.ClientID)
+	if err != nil {
+		// Version conflict — return steps the client missed.
+		missed, dbErr := h.DB.GetStepsSince(rkey, body.ClientVersion)
+		if dbErr != nil {
+			log.Printf("SubmitSteps: GetStepsSince: %v", dbErr)
+			http.Error(w, "Internal error", http.StatusInternalServerError)
+			return
+		}
+		currentVersion, _ := h.DB.GetDocVersion(rkey)
+		stepJSONs := make([]string, len(missed))
+		for i, s := range missed {
+			stepJSONs[i] = s.JSON
+		}
+		w.Header().Set("Content-Type", "application/json")
+		w.WriteHeader(http.StatusConflict)
+		json.NewEncoder(w).Encode(map[string]interface{}{
+			"version": currentVersion,
+			"steps":   stepJSONs,
+		})
+		return
+	}
+
+	// Broadcast to other room members via WebSocket.
+	if room := h.CollaborationHub.GetRoom(rkey); room != nil {
+		type stepsMsg struct {
+			Type     string   `json:"type"`
+			Steps    []string `json:"steps"`
+			Version  int      `json:"version"`
+			ClientID string   `json:"clientID"`
+		}
+		data, _ := json.Marshal(stepsMsg{
+			Type:     "steps",
+			Steps:    body.Steps,
+			Version:  newVersion,
+			ClientID: body.ClientID,
+		})
+		room.Broadcast(data)
+	}
+
+	h.jsonResponse(w, map[string]int{"version": newVersion}, http.StatusOK)
+}
+
+// GetSteps returns all steps since the given version.
+//
+// GET /api/docs/{rkey}/steps?since={v}
+// Response 200: {"version": N, "steps": ["...json..."]}
+func (h *Handler) GetSteps(w http.ResponseWriter, r *http.Request) {
+	user := h.currentUser(r)
+	if user == nil {
+		http.Error(w, "Unauthorized", http.StatusUnauthorized)
+		return
+	}
+	rkey := r.PathValue("rkey")
+
+	sinceStr := r.URL.Query().Get("since")
+	var since int
+	if sinceStr != "" {
+		fmt.Sscanf(sinceStr, "%d", &since)
+	}
+
+	rows, err := h.DB.GetStepsSince(rkey, since)
+	if err != nil {
+		log.Printf("GetSteps: %v", err)
+		http.Error(w, "Internal error", http.StatusInternalServerError)
+		return
+	}
+	version, _ := h.DB.GetDocVersion(rkey)
+	stepJSONs := make([]string, len(rows))
+	for i, s := range rows {
+		stepJSONs[i] = s.JSON
+	}
+	h.jsonResponse(w, map[string]interface{}{
+		"version": version,
+		"steps":   stepJSONs,
+	}, http.StatusOK)
+}