Implement persistent identity

[shikokuchuo]

Closes #47.

When authentication is enabled, document changes are now attributed to the user who made them. Previously, every browser session generated a random anonymous identity, making it impossible to tell who edited what in the document history.

This means:

• Consistent attribution: The same person always shows up as the same author, regardless of which device or browser they use
• Replay recognition: In replay mode, your own changes are labeled "Me" instead of an opaque identifier, making it immediately clear which edits are yours vs. others
• Privacy by design: The identity stored in document history is a one-way hash - it can't be reversed to reveal email addresses or other personal information
• No-auth fallback: When authentication is disabled, everything works exactly as before with anonymous random identities

Deferred

• Display names in replay: A future addition will map identities back to human-readable names and emails, so other collaborators show as "Alice" rather than a short hex code. The design for where to store this mapping (client-side, server-side, or hybrid) is still open.