Add web server & collaboration spec (ADRs C012-C020) and foundation crates

CLAUDE.md

@@ -220,6 +220,45 @@ The workspace is a set of focused crates (one responsibility each). Key groups:
   `TC-*` cases, embedded fixtures, page-count/glyph-coverage canaries, SSIM
   primitives, and the `load_bench` open-latency benchmark). See
   `loki-acid/README.md`.
+- **Server (collaboration & storage)** — spec:
+  [docs/adr/LOKI_WEB_SERVER_SPEC.md](docs/adr/LOKI_WEB_SERVER_SPEC.md)
+  (ADRs C012–C020). `loki-model` (server-side IDs, `EncryptionTier`,
+  RBAC `Role`/`Action`, EU-pinned `Residency`), `loki-crypto` (DEK envelope
+  encryption + crypto-agile `KeyWrap`: symmetric KEK for Tiers 0/1, X25519
+  for Tier-2 zero-knowledge), `loki-server-audit` (hash-chained audit log),
+  `loki-server-store` (Postgres/SQLx + `object_store` ports, with in-memory
+  test impls; `doc_meta.snapshot_seq` is the move-forward-only compaction
+  guard), `loki-server-collab` (WebSocket relay, `FanOutBus`:
+  `PgNotifyBus`/`InMemoryBus`, and the ADR-C013 `Compactor` — a periodic
+  task folds each Tier-0/1 oplog backlog into a Loro snapshot and
+  truncates; Tier-2 documents are compacted by clients via
+  `PUT /v1/documents/{doc}/snapshot`), `loki-server-auth` (OIDC relying
+  party + RBAC; keys come from the IdP's JWKS endpoint with caching and
+  rotation-on-unknown-kid, or a static PEM), `loki-server-api` (REST
+  `/v1`, problem+json errors, `E2eeCapabilityDisabled` = the canonical
+  Tier-2 409), and the `loki-server` binary (env config with sovereignty
+  validation, graceful shutdown). Deliberate deferrals are marked in-code:
+  `TODO(kms)` (KEK from Vault/KMS instead of env), `TODO(headless-c025)`
+  (apalis export job queue), `TODO(ws-membership)` (workspace-scope roles +
+  listing join).
+- **Headless (print & conversion)** — spec:
+  [docs/adr/LOKI_HEADLESS_SERVER_SPEC.md](docs/adr/LOKI_HEADLESS_SERVER_SPEC.md)
+  (ADRs C021–C028). `loki-convert` (ADR-C024 conversion matrix over the
+  existing import/export crates — DOCX/ODT ↔ each other and → EPUB/PDF;
+  XLSX ↔ ODS; PPTX/ODP/ODG gated behind the unbuilt ACID PPTX generator,
+  ratified decision §5.1; unsupported pairs are a typed
+  `ConversionUnsupported`), `loki-print` (ADR-C023 blocking IPP client:
+  Print-Job dispatch of rendered PDF with copies/duplex/media/colour
+  attributes, Get-Job-Attributes polling), and the `loki-headless` CLI
+  (`convert`/`render`/`print`/`formats`; print renders non-PDF inputs via
+  `loki-convert` first). The whole print path is CPU-only already
+  (Parley layout → pdf-writer), so no GPU is involved. Deferrals marked
+  in-code in `loki-headless/src/main.rs`: `TODO(headless-c025)` (apalis
+  worker + HTTP endpoint), `TODO(headless-c021)` (vello_cpu thumbnails),
+  `TODO(headless-c022)` (krilla migration for PDF/A-2b — `pdf-a2b` is a
+  typed `ProfileUnsupported` today), `TODO(headless-c023-discovery)`
+  (DNS-SD printer discovery), `TODO(headless-c027)` (fail-closed fonts),
+  `TODO(headless-c028)` (TEE attestation).
 
 The **Publish** ribbon tab in `loki-text` drives PDF/X + EPUB export and the
 Dublin Core metadata editor.