fix: add owner-DID-scoped doc routes so collaborators can view shared documents

.gitignore

···
 .Trashes
 ehthumbs.db
 Thumbs.db
-server
+/server

cmd/server/main.go

···
 	mux.HandleFunc("POST /docs/new", h.NewDocumentSubmit)
 	mux.HandleFunc("GET /docs/{rkey}", h.DocumentView)
 	mux.HandleFunc("GET /docs/{rkey}/edit", h.DocumentEdit)
+	// Collaborator-scoped routes (owner DID in path)
+	mux.HandleFunc("GET /docs/{did}/{rkey}", h.CollaboratorDocumentView)
 
 	// API
 	mux.HandleFunc("POST /api/render", h.APIRender)

internal/handler/handler.go

···
 	http.Redirect(w, r, fmt.Sprintf("/docs/%s/edit", rkey), http.StatusSeeOther)
 }
 
-// DocumentView renders a document as HTML.
-func (h *Handler) DocumentView(w http.ResponseWriter, r *http.Request) {
-	user := h.currentUser(r)
-	if user == nil {
-		http.Redirect(w, r, "/auth/atproto", http.StatusSeeOther)
-		return
-	}
-
-	rkey := r.PathValue("rkey")
-	client, err := h.xrpcClient(user.ID)
+// documentView is the shared implementation for viewing a document given an ownerDID and rkey.
+func (h *Handler) documentView(w http.ResponseWriter, r *http.Request, ownerUserID, ownerDID, rkey string) {
+	client, err := h.xrpcClient(ownerUserID)
 	if err != nil {
 		http.Error(w, "Could not connect to PDS", 500)
 		return
 	}
 
-	value, _, err := client.GetRecord(client.DID(), collectionDocument, rkey)
+	value, _, err := client.GetRecord(ownerDID, collectionDocument, rkey)
 	if err != nil {
 		http.NotFound(w, r)
 		return
···
 		rendered, _ = render.Markdown([]byte(doc.Content.Text.RawMarkdown))
 	}
 
+	user := h.currentUser(r)
 	type DocumentViewData struct {
 		Doc      *model.Document
 		Rendered template.HTML
···
 		User:    user,
 		Content: DocumentViewData{Doc: doc, Rendered: template.HTML(rendered)},
 	})
+}
+
+// DocumentView renders a document as HTML (owner viewing their own doc).
+func (h *Handler) DocumentView(w http.ResponseWriter, r *http.Request) {
+	user := h.currentUser(r)
+	if user == nil {
+		http.Redirect(w, r, "/auth/atproto", http.StatusSeeOther)
+		return
+	}
+
+	rkey := r.PathValue("rkey")
+	client, err := h.xrpcClient(user.ID)
+	if err != nil {
+		http.Error(w, "Could not connect to PDS", 500)
+		return
+	}
+
+	h.documentView(w, r, user.ID, client.DID(), rkey)
+}
+
+// CollaboratorDocumentView renders a document owned by another user (collaborator access).
+func (h *Handler) CollaboratorDocumentView(w http.ResponseWriter, r *http.Request) {
+	user := h.currentUser(r)
+	if user == nil {
+		http.Redirect(w, r, "/auth/atproto", http.StatusSeeOther)
+		return
+	}
+
+	ownerDID := r.PathValue("did")
+	rkey := r.PathValue("rkey")
+
+	ownerUser, err := h.DB.GetUserByDID(ownerDID)
+	if err != nil {
+		http.NotFound(w, r)
+		return
+	}
+
+	h.documentView(w, r, ownerUser.ID, ownerDID, rkey)
 }
 
 // DocumentEdit renders the editor for a document.
···
 
 	h.DB.DeleteInvite(invite.Token)
 
-	http.Redirect(w, r, "/docs/"+rKey, http.StatusSeeOther)
+	// Redirect to owner-scoped document URL so the view handler knows whose PDS to query.
+	http.Redirect(w, r, "/docs/"+invite.CreatedBy+"/"+rKey, http.StatusSeeOther)
 }
 
 // --- API: Comments ---