Migrate existing workspaces and prove cross-space isolation

[brylie]

Problem

The shard implementation is not safe to expose until existing single-space data migrates losslessly and the system proves that a client, token, or presence update cannot cross a Space boundary.

Scope

• Implement the approved migration of existing Documents, Collections, records, links, access grants, snapshots, and audit attribution into one default Space and the selected shard layout.
• Make migration idempotent, recoverable, and observable; document rollback and backup expectations.
• Add end-to-end fixtures with at least two Spaces, browser/Yjs clients, and scoped MCP tokens.
• Prove that content, search, awareness, holds, audit/provenance, persistence keys, and mutations stay within the authorized Space and shard.
• Exercise restart/reload and migration scenarios against representative workspace data.

Non-goals

• Designing the shard model or building its core routing/persistence primitives.
• New Space-creation UI beyond what is needed to validate the migration.
• Multi-tenant authentication and user administration.

Dependencies

Blocked by #113, which consumes the design in #112. This completes the foundational parts of #13 before #6 exposes multi-space workflows broadly.

Done when

An existing Phase-0 workspace is migrated losslessly into a default Space, and automated end-to-end tests prove no UI, Yjs, MCP, search, awareness, hold, persistence, or audit operation crosses a Space boundary.

[brylie]

Priority unset → P0: multi-space cannot be exposed safely until existing data migrates losslessly and cross-space isolation is proved end to end. This issue is blocked by #113 and directly unblocks #6.