feat(dsheet): un-fence durable + edit-permission planes, keyed on owner-identity bind

[nadeem-fileverse]

A session's bound ownerIdentityDid is the activation switch: unbound
rooms (all existing dsheet rooms and everything legacy clients create)
behave exactly as before, while bound rooms - only creatable by a
client presenting a verified identityToken - get full ddoc parity.

• create binds-if-presented for dsheet (ddoc still hard-requires;
  invalid proof is always 401), join role resolution and heal un-gated
• portal pin runs for all dsheet creates (dsheet-typed creates
  previously skipped the anti-hijack pin entirely)
• DocumentMeta gains insert-only appType, returned by
  /list-my-documents so recovery can route sheet vs document
• createUpdate stamps appType from the session row instead of
  trusting callers (/flush previously mislabeled dsheet rows)
• terminate no longer hard-deletes dsheet update/commit rows; orphan
  GC goes app-agnostic with a live-sibling-session guard and now
  sweeps commit rows
• rail admission and the update/snapshot/awareness revocation
  rechecks key on socket.data.editPlaneEnforced (ddoc always,
  dsheet iff bound); a heal kicks pre-heal unenforced sockets
• backfill-apptype.ts extended to stamp DocumentMeta (run post-deploy)