feat: import a Markdown file as a page

[christianhuening]

Closes #8.

Both things a user naturally tries to get a Markdown document into knot were dead ends: there was no upload control, and pasting the source landed as literal text. The backend endpoint (POST /api/docs/{id}/markdown) already existed and nothing in web/src had ever called it.

The issue's open question

It asked whether importing into a non-empty page duplicates it. It does, and there's now a test that pins it:

expected: replaced
actual:   "# Original\n\n# Imported\n"

import_inline hands its parsed bytes to Event::ApplyUpdate, which Yjs merges into the live fragment. That's correct for the only existing caller (from_template always targets a fresh doc) and wrong for importing over a page you've already used.

Rather than restrict imports to empty pages, this adds ?mode=replace|append, routing replace through the Event::ReplaceWithMarkdown that history restore already uses. append stays the wire default, so from_template and any existing API client are byte-for-byte unaffected; only the new UI opts into replace.

What's here

Import control — a FileUp button beside Export, editor+ only. Guards the server's 1 MB cap client-side (axum's own rejection is a bare 400), checks whether the page has content, confirms before overwriting, then POSTs. No refetch needed: the room actor fans the replace out over the WebSocket the editor is already on.

Paste — looksLikeMarkdown converts on a fence, a GFM table or a ## heading; otherwise it needs two distinct cue kinds or a repeated block cue. Headings only count at a block start, which is what stops a pasted Python or shell snippet reading as a pile of # headings. The asymmetry is deliberate: a miss pastes plain text exactly as before, a false positive would mangle what someone pasted. Three opt-outs: a rich-text clipboard, a code block, and ⌘⇧V.

Converted HTML goes through marked → task-item promotion → a new DOMPurify profile before Tiptap sees it. Markdown passes raw HTML straight through, so that sanitizer is required, not decorative.

Two fixes found along the way

• Imported checklists rendered as plain bullets. from_markdown stores checked as the Yjs string "true"/"false", but TaskListExtension only matched booleans. Pre-existing — it hit create-from-template too — but import made it reachable. The Markdown round-trip and doc_tasks rows were correct all along; only rendering was wrong.
• pnpm lint was red on main (4 errors, 1 warning) because CI ran tsc and test but not lint. Two of those were real latent bugs: onClick and onPickTemplate are typed to return void, so their inline async handlers left rejections unhandled — a failed setTemplate would have surfaced as an unhandled rejection instead of the intended error toast. All five fixed at the cause, and pnpm lint is now a CI step.

Testing

• Rust — new markdown_import_integration.rs: append-duplicates (pins the default), replace-swaps, replace-into-empty, bad mode → 400, viewer → 403, anon → 401, non-UTF-8 → 422, and attribution on the replace path.
• Vitest — 20 cases over the paste heuristic including the false-positive ones (C# is fine, interleaved Python comments, a #-commented config), the sanitizer, the import button's confirm gate, and the checklist normaliser.
• Playwright — import into an empty page, replace a non-empty one, paste Markdown source, an imported checklist keeping its checkboxes, plus a templates spec covering the two handlers the lint fix refactored (neither had any coverage).

331 Rust tests, 103 vitest, clippy, fmt and tsc all green. E2E is 42 passing; the 4 failures (oidc, ws-reconnect, editor-toolbar, one tree-reorder) reproduce identically on main with this branch stashed — two of them are macOS-only, since the toxiproxy sidecar uses network_mode: host and lands in Docker's Linux VM rather than the host.

Not doing

Titles are never derived from a leading #; the workspace zip import is untouched; relative image paths in an imported file are imported as-is and won't resolve.

Design and plan are committed under docs/superpowers/.

🤖 Generated with Claude Code