Add public readonly mode (AUTH_MODE=readonly)

[EthanThatOneKid]

Summary

Adds a third authentication mode — \AUTH_MODE=readonly\ — where anyone can view the vault without signing in, but writes are silently no-oped. Extends the existing binary auth model (on/off) to three modes: \ull,
eadonly, \disabled.

Changes

Server-side

• \src/server/config.js\ — new \�uth.mode\ field from \AUTH_MODE\ env var
• \src/server/index.js\ — auth state middleware per-request, mode-aware
  equireAuth\
• \src/server/api/fs.js\ — no-op gates on all write handlers; intercept .obsidian/app.json\ reads to force preview mode
• \src/server/api/electron.js\ — no-op gate on \ rash\
• \src/server/api/vaults.js\ — no-op gates on \move\ and
  emove\
• \src/server/api/bootstrap.js\ — thread \�uthMode\ through cache build chain

Client-side

• \src/client/boot.js\ — CSS to hide edit UI elements + keyboard shortcut guard
• \src/client/index.html\ — add \id=ow-logout\ to sign-out form for CSS targeting

Docs

• \README.md\ — document all three \AUTH_MODE\ values in Authentication and Configuration sections

How it works

When \AUTH_MODE=readonly\ is set with a password:

1. Anyone can load the app, browse notes, navigate — all reads are public
2. The renderer forces preview/reading mode by intercepting .obsidian/app.json\ config
3. Edit controls are hidden with CSS; Ctrl+E/Cmd+E keyboard shortcut is blocked
4. Write operations (save, create, rename, delete) return { ok: true }\ but don't persist
5. Authenticated users get full read/write access as before

Testing

All 15 existing tests pass (7 bootstrap-cache + 8 vaults-api).