feat(pub): persist like identity so cancel/duplicate clicks are per viewer

[waterbro-8]

Summary

Follow-up to #59.

Likes on published documents are counted in PubDoc.thumbUpCount and gated only by localStorage in the browser. Reloading on another device, clearing site data, or calling the increase endpoint twice still increments. #59 persists the decrement; it does not define a viewer.

Expected

• A successful like is associated with a stable viewer identity (session, signed-in user, or documented anonymous token).
• Duplicate increase from the same viewer is idempotent.
• Cancel only succeeds if that viewer currently holds a like.
• Counts stay nonnegative and survive reload.

Non-goals

• Changing the public like UI copy or appearance (fix(ui): synchronize themes and restore readable controls across client surfaces #57 / fix(ui): unify document alignment, themes and empty states #58).