fix(pub): persist published document like cancellation (#59)

[waterbro-8]

Summary

Closes #59.

Cancelling a like on a published document reported success and updated the UI, but the decrease endpoint returned success without writing. Reload restored the higher count.

Changes

• PATCH /api/pub/thumb-up-decrease/[publishId] now decrements thumbUpCount when it is greater than zero.
• Missing publications return an error instead of a false success.
• Duplicate cancellation against a zero count is a no-op (nonnegative clamp).
• Like identity remains browser-local (localStorage); this PR does not add per-user like records.
• Added persisted-readback unit coverage.

Test plan

• npx vitest run src/__tests__/api/thumb-up-routes.test.ts (5 tests)
• Pre-commit: lint, format, 312 vitest tests, 59 CLI tests

Out of scope

• Server-side like identity / duplicate-click across browsers
• Rate limiting public like endpoints

[waterbro-8]

Review

CI: test, docker-build, Dependency review, Scorecard pass.

This matches #59. The decrease path actually writes, clamps at zero, and stops returning success for a missing publication. Tests cover persist, nonnegative duplicate cancel, not-found, and error redaction.

Notes (non-blocking)

• The button still decrements the UI before the request. If decrease fails, the count stays low until reload. Worth a follow-up rollback, not a merge blocker for this bug.
• Like identity is still localStorage. That is called out and tracked in #72.

Verdict: approve for merge once a CODEOWNER who is not the author signs off (repo requires last-push approval).

[waterbro-8]

Follow-up: published like button rolls back count, liked state, and localStorage if increase/decrease fails. Head: 61296ca.

[wadrzl]

LGTM。Bug 修复正确：decrease 端点真正写入 + 零值钳制 + 404 返回错误；按钮组件失败时三态回滚（count/liked/localStorage）。测试覆盖充分，错误信息不泄露存储细节。

已知限制（localStorage 身份、无速率限制）已在 PR 描述中说明并 track 到 #72，不阻塞合并。

[Bindy-lbb]

LGTM. The decrease endpoint now actually persists the decrement with a nonnegative clamp via updateMany with gt: 0, and missing publications correctly return an error instead of a false success. The component-level rollback on failure (count + liked state + localStorage) is clean. Good test coverage across the API (including the storage-error leak guard) and the button rollback path. Ship it.

[waterbro-8]

Rebased onto main after #65. CHANGELOG conflict resolved. CI will re-run; CODEOWNERS approval was dismissed by the force-push.

[Bindy-lbb]

Re-approved after rebase onto #65. The decrease endpoint with nonnegative clamp, missing-publication error, and component-level rollback remain correct. CI green, LGTM.

[sun-970]

Review — Approve (merge blocked on rebase)

Head 3f6cda0. CI test / docker-build / dependency review / Scorecard green.

The #59 bug is actually fixed: updateMany with thumbUpCount.gt: 0 writes the decrement, missing publications return an error instead of a false success, duplicate cancel at zero is a no-op. Button rolls back count / liked / localStorage on increase or decrease failure. Tests cover persist, nonnegative clamp, 404, error redaction, and cancel-failure rollback. Errors do not leak storage details.

Merge blocker

mergeable: CONFLICTING / DIRTY against current main. Do not merge until rebase + CI re-green.

Non-blocking

• Like identity is still localStorage (tracked in #72).
• No rate limit on public like endpoints (called out in the PR).