Version history and restore

Every Durable Object draft save and publish already creates an immutable document-version record. TenantWorkspaceDocumentStore now exposes that history through listVersions(siteId) and supports restoreDraft(siteId, sourceVersion, expectedDraftVersion, actor).

Restore never overwrites a draft in place. It reads the selected immutable version, verifies the current draft version for optimistic concurrency, and saves the restored document as a new draft version attributed to the actor. A later publish remains an explicit, separately authorized action.

Version history is tenant-local to the Durable Object. The Worker authorizes content.view before listing history and content.edit before restoring; the object deliberately receives only the already-authorized actor ID.