feat(editor): CodeMirror live-cursor description editor (ADR 0011, 2/2)

[Musiker15]

Summary

Part 2 of 2 — completes live cursors (ADR 0011). With NEXT_PUBLIC_FEATURE_LIVE_CURSORS="true", the card description field becomes a CRDT-aware CodeMirror 6 editor rendering remote collaborators' carets + selections, consuming the encrypted cursor channel from #73.

⚠️ Crypto-relevant (it instantiates CardCursorProvider, which encrypts cursor awareness under the BoardKey). The transport itself was reviewed in #73.

How it fits the existing model

The editor binds CodeMirror to the same card Y.Text the drawer already mirrors into its description state. So:

• typing → Y.Text mutates → the drawer's existing observer updates description → Save / PATCH / export / encryption are all unchanged;
• yCollab(yText, cursorAwareness) renders remote carets in each peer's presence colour.

Markdown-source model preserved — no rich-text migration, exactly as the ADR decided.

Changes

• description-editor.tsx (new): CodeMirror 6 + yCollab + markdown() + line-wrapping + an MSK dark theme + a11y content attributes (role=textbox, aria-multiline, aria-label). Creates a CardCursorProvider for the card and destroys it on unmount (the shared Y.Doc / doc-sync provider are left alone — they're cached).
• card-drawer.tsx: renders <DescriptionEditor> when the flag is on, else the existing textarea. Dynamically imported (ssr:false) so the CodeMirror bundle never lands in the initial page load.
• Deps: @codemirror/{state,view,commands,lang-markdown} + y-codemirror.next.

Validation

• pnpm build ✅ (CodeMirror + y-codemirror.next bundle; dynamic import resolves)
• pnpm typecheck + pnpm lint clean; full unit suite 171 green
• The unit-testable logic (cursor awareness PII guard) was covered in feat(realtime): live-cursor transport (ADR 0011, part 1/2) #73. This PR is editor wiring, validated by the production build + the manual plan below — a CodeMirror+Yjs render test would be integration-level (jsdom + heavy mocks) for thin value.

Test plan

• CI green
• Merge → redeploy mskanban-ws.service (for the part-1 awareness relay) + set NEXT_PUBLIC_FEATURE_LIVE_CURSORS="true" + rebuild
• Two browsers, two users, same card open: typing in one shows the other's coloured caret + live text; selections render; no PII in the awareness frames (DevTools → WS shows only ciphertext)
• Flag off (default): the plain textarea renders, doc sync unaffected
• a11y: editor reachable + editable by keyboard; remote carets are decorative

🤖 Generated with Claude Code