feat(docs): add document permission controls

[DR-Univer]

Summary

• add command-backed Facade APIs for document Unit, Section, Paragraph, and Entity permissions
• align Unit and object Facades around setReadOnly(), no-argument setEditable(), and effective canEdit() checks
• execute every public Facade write API directly through the Document permission Command; Facade methods do not call other Facade methods
• add complete API comments and copy-ready examples for whole-Document, Section, Paragraph, and stable Entity permissions
• resolve Paragraph and Drawing example targets from the active Document instead of relying on placeholder ids, and execute those flows in the Docs permission suite
• register all whole-Document permission points when a document unit is created so collaboration can hydrate them before any Facade setter is called
• enforce document Edit, Copy, Print, Export, and Comment permissions across command, clipboard, drawing selection, transform, and async paste paths
• integrate the unified thread-comment commands: denied Comment permissions block local text and Drawing comment entry points while collaboration/changeset replay remains applicable
• disable Document and Sheet Drawing comment entry points when Comment permission is denied, without preventing read-only comment viewing
• add the renderer moveEnabled capability used to make read-only floating elements non-interactive
• cancel deferred document editor focus when the renderer controller is disposed
• mirror the Sheet permission-point architecture with independent classes/files for Document, Section, Paragraph, and Entity actions
• extend OSS @univerjs/protocol UnitObject values for the new stable object scopes; the external Protocol repository is unchanged

Rebased onto dev at 79a5b5609c.

Validation

• @univerjs/docs: 26/26 permission controller tests passed, including object-type mapping and Drawing Comment entry enforcement
• @univerjs/sheets-thread-comment-ui: 2/2 permission controller tests passed, including Drawing anchors and Drawing UI entry enforcement
• @univerjs/thread-comment: 23/23 command tests passed
• @univerjs/sheets-thread-comment: 10/10 Facade tests passed
• @univerjs/docs-thread-comment: 1/1 text-range comment command test passed
• @univerjs/docs-thread-comment-ui: 2/2 panel tests passed
• @univerjs/docs-ui: 23/23 clipboard tests passed
• @univerjs/docs-drawing-ui: 14/14 drawing permission tests passed
• @univerjs/engine-render: 3/3 transformer tests passed
• document selection renderer suite: 18/18 passed
• nested Board/Slide disposal regression: 5/5 passed with the OSS fix consumed by Pro
• package typechecks passed for docs, docs-thread-comment-ui, sheets-thread-comment-ui, docs-ui, docs-drawing-ui, and engine-render
• targeted ESLint and the pre-commit hook passed with no errors

Pull Request Checklist

• No related ticket or issue is available.
• Naming conventions are followed.
• Unit tests cover the changes.
• No breaking change is introduced.

[github-actions]

Playwright test results

 12 passed

Details

 12 tests across 5 suites
 4 minutes, 40 seconds
 b6c42da
 For more information, see full report and artifacts

[codecov]

Codecov Report

❌ Patch coverage is 91.52299% with 59 lines in your changes missing coverage. Please review.
✅ Project coverage is 81.23%. Comparing base (5f5a779) to head (b6c42da).

Files with missing lines	Patch %	Lines
...ervices/permission/document-permission-resolver.ts	86.84%	20 Missing ⚠️
...s/sheets-hyper-link-ui/src/views/CellLinkPopup.tsx	11.11%	8 Missing ⚠️
.../docs/src/controllers/doc-permission.controller.ts	96.59%	6 Missing ⚠️
...ontrollers/doc-drawing-update.render-controller.ts	92.85%	5 Missing ⚠️
...ocs-ui/src/services/clipboard/clipboard.service.ts	88.09%	5 Missing ⚠️
...docs-ui/src/services/doc-paragraph-menu.service.ts	82.60%	4 Missing ⚠️
...ocs/src/services/permission/document-permission.ts	92.72%	4 Missing ⚠️
...r-link-ui/src/services/hyper-link-popup.service.ts	88.88%	3 Missing ⚠️
...mmands/commands/set-document-permission.command.ts	75.00%	2 Missing ⚠️
...ages/docs-hyper-link-ui/src/views/DocLinkPopup.tsx	92.30%	1 Missing ⚠️
... and 1 more

Additional details and impacted files

@@            Coverage Diff             @@
##              dev    #7586      +/-   ##
==========================================
+ Coverage   81.18%   81.23%   +0.04%     
==========================================
  Files        2702     2715      +13     
  Lines      169885   170511     +626     
  Branches    41931    42229     +298     
==========================================
+ Hits       137918   138511     +593     
- Misses      31919    31952      +33     
  Partials       48       48              

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[DR-Univer]

Regression follow-up (runtime switching, multi-unit isolation, keyboard/native entry points, and permission combinations):

• Fixed Docs Cut so Edit is preflighted before clipboard writes, including paragraph/section/object targets.
• Verified 146 passing Docs permission/UI tests and 49 passing Sheets permission/editor/clipboard tests.
• @univerjs/docs-ui typecheck and modified-file lint pass.
• The local component-only DocLinkPopup (5 tests) and CellLinkPopup (4 tests) suites remain blocked by the known split React runtime in the nested Pro/OSS install; their service/command suites pass and the failure is empty React rendering rather than permission behavior.

Latest commit: 743dba0aa7.