Fix parent doc viewer: sign comment permissions server-side

Client-side permission overrides invalidated the JWT. Move the
comment-only config to a new PIN-protected endpoint that signs
the correct permissions before returning to the browser.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

public/admin.html

@@ -793,6 +793,6 @@
     </div>
   </div>
 
-  <script src="admin.js?v=4"></script>
+  <script src="admin.js?v=5"></script>
 </body>
 </html>

public/admin.js

@@ -3341,16 +3341,11 @@ async function openAdminDocViewer(id, key, filename, title) {
     adminDocsEditorInstance = null;
   }
 
-  const { onlyofficeUrl, config } = await api(`/api/docs/bykey/${key}/editor-config`).catch(() => null) || {};
+  const { onlyofficeUrl, config } = await api(`/api/admin/docs/bykey/${key}/editor-config`).catch(() => null) || {};
   if (!onlyofficeUrl || !config) {
     frame.innerHTML = `<div class="docs-error">Could not load document config.</div>`;
     return;
   }
-  // Parent can comment but not edit the student's text
-  config.editorConfig = config.editorConfig || {};
-  config.editorConfig.mode = 'edit';
-  config.document = config.document || {};
-  config.document.permissions = { edit: false, comment: true, download: true, print: true };
 
   function initEditor() {
     adminDocsEditorInstance = new window.DocsAPI.DocEditor('admin-doc-frame', config);

server.js

@@ -2546,13 +2546,13 @@ app.get('/api/docs/config', (req, res) => {
   res.json({ onlyofficeUrl: ONLYOFFICE_URL, serverUrl: SERVER_URL });
 });
 
-// Returns a fully-signed OnlyOffice editor config — lookup by doc key (for admin)
-app.get('/api/docs/bykey/:key/editor-config', (req, res) => {
+// Returns a fully-signed OnlyOffice editor config — parent comment-only view (PIN required)
+app.get('/api/admin/docs/bykey/:key/editor-config', requirePin, (req, res) => {
   const doc = db.prepare(`SELECT d.*, s.name AS student_name FROM documents d JOIN students s ON s.id = d.student_id WHERE d.doc_key = ?`).get(req.params.key);
   if (!doc) return res.status(404).json({ error: 'Not found' });
   const config = {
-    document: { fileType: 'docx', key: doc.doc_key, title: doc.title, url: `${SERVER_URL}/api/docs/file/${doc.filename}`, permissions: { edit: false, download: true, print: true } },
-    editorConfig: { user: { id: 'parent', name: 'Parent' }, mode: 'view', lang: 'en', customization: { logo: { visible: false }, compactHeader: true, toolbarNoTabs: true } },
+    document: { fileType: 'docx', key: doc.doc_key, title: doc.title, url: `${SERVER_URL}/api/docs/file/${doc.filename}`, permissions: { edit: false, comment: true, download: true, print: true } },
+    editorConfig: { user: { id: 'parent', name: 'Parent' }, mode: 'edit', lang: 'en', customization: { logo: { visible: false }, compactHeader: true, toolbarNoTabs: true } },
     type: 'desktop', height: '100%', width: '100%',
   };
   const token = jwtSign(config);