feat(html): a text editor that owns the edit

[andiwand]

🤖 Generated with Claude Code

Fourth of five; #874 is merged, so this now sits on main. See
docs/design/document-editing.md decisions 6 and 6b.

What this one does

The editor cancels what the browser was about to do and splices the page
itself, so the markup stays what the renderer wrote and every change has an
operation behind it.

Reading the run back afterwards only worked while an edit stayed inside one
run. Contenteditable's answer to a selection spanning two paragraphs is
browser-specific — a <div> wrapper here, a merged <b> there — and maps onto
nothing in the element tree.

So a reader can now:

• type, replace and delete across runs and across paragraphs;
• press Enter to split a paragraph, keeping the formatting on both sides;
• press Backspace at the start of one to merge it into the paragraph before;
• paste plain text over as many lines as it holds.

Undo and redo are the editor's

Cancelling every edit leaves the browser's own stack empty, so undo had to come
with this. Each step holds the operations it puts on the wire and the two
halves of taking it back, so canUndo and the chord agree at last and a host's
undo button is live. One beforeinput is one step.

Two things the browser does not always state

• A delete whose range it left out is one character, in the direction the
  key names — or, at the start of a paragraph, the boundary itself, which
  merges and takes no character. A word or line delete is not guessed at:
  guessing where a word ends takes away text the reader did not name.
• A composition cannot be cancelled, so the editor lets it finish and reads
  the run back on compositionend. With the page as the model there is nothing
  to reconcile — the run's text is the operation.

insertText gains a parent form for the paragraph Enter just made, which
holds no run to sit beside; Document::append_text is the same in C++, on the
document rather than on a handle like the other structural edits.

Checks

test/browser/text/tests.html — 48 checks, driving beforeinput and asserting
both the page and the log. defaultPrevented no longer says whether an edit
was taken, because the editor cancels either way, so the checks read the
refusal channel instead. Run headless:
test/browser/text/serve then Chrome --headless --dump-dom.