Fix parent doc viewer: sign comment permissions server-side

Client-side permission overrides invalidated the JWT. Move the
comment-only config to a new PIN-protected endpoint that signs
the correct permissions before returning to the browser.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

public/admin.html

@@ -793,6 +793,6 @@
     </div>
   </div>
 
-  <script src="admin.js?v=4"></script>
+  <script src="admin.js?v=5"></script>
 </body>
 </html>