fix: non-owner Resolve/Un-Resolve blocked in server-sync mode

[kasunben]

Summary

• Root cause: the resolve button handler called syncThread(t), which sends a full POST /threads upsert — an endpoint gated by checkOwnership. Any non-owner click → 403. The failure was silent (a console.warn) so the resolved state appeared to toggle locally but never reached the server, creating an invisible inconsistency with offline/BC/P2P modes where resolve is open to everyone
• Server fix: PATCH /threads/:id/resolve now accepts { resolved: boolean, resolvedBy?, resolvedAt? } and handles both directions — resolved=true resolves, resolved=false un-resolves; no ownership check on this endpoint
• Client fix: added syncResolve(thread) — same BC/P2P broadcast and dirty-flag cleanup as syncThread, but calls PATCH /threads/:id/resolve instead of POST /threads; resolve button handler now calls syncResolve instead of syncThread
• Bumped version to 0.5.15; rebuilt annotate.min.js

Type

• Bug fix

Affected modes

Server-sync (Mode 3) only — the bug was a server-side ownership gate. Offline, BroadcastChannel, and P2P modes were already unrestricted and are unaffected.

Testing

New integration tests (tests/integration/resolve-access.test.mjs — 7 tests):

• Owner can resolve their own thread → 200
• Non-owner can resolve a thread they did not create → 200
• Non-owner can un-resolve a thread they did not create → 200
• Un-resolve clears resolvedBy and resolvedAt
• Resolve bumps updatedAt so incremental ?since= pulls see the change
• Un-resolve bumps updatedAt so incremental pulls see the change
• Returns 404 for a thread id that does not exist

Updated E2E test (tests/e2e/server-sync.spec.js):

• expectResolve() helper added — watches for PATCH .../resolve instead of POST /threads
• "User A resolves → User B sees resolved card after pull" passes with the new PATCH endpoint

Full suite: 89 unit + integration ✅ · 15/15 E2E ✅

Breaking changes

None. PATCH /threads/:id/resolve now accepts a resolved boolean field (previously it only resolved, never un-resolved). Callers that omit resolved get the same behaviour as before (resolved=true is the default path).

Checklist

• server/routes/threads.js — endpoint expanded and ownership check confirmed absent
• assets/js/annotate.js — syncResolve() added; resolve handler updated
• tests/integration/resolve-access.test.mjs — 7 new tests
• tests/e2e/server-sync.spec.js — resolve test updated to await PATCH
• annotate.min.js rebuilt (npm run build)
• Version bumped (0.5.14 → 0.5.15)
• CLAUDE.md updated (Phase G, REST API table, Key Implementation Notes, Future work item removed)
• README.md updated (Roadmap item moved to Shipped, sync checklist updated)

Closes #22

🤖 Generated with Claude Code