feat(addin): unmock versioning — real upload/download against docver API

Replace the in-memory versioningService with real calls to the docver
group (/api/documents/*) via apiClient with the ticket-issued Bearer;
keep the mock only for ?addindemo (authService.isDemoMode).

- uploadVersion: multipart POST /api/documents/versions (file, optional
  pdf when non-empty, clientVersionId, fields JSON, trimmed message,
  fileName) — identity fields are never sent (userId/userName/templateId
  in the form = 400 per the 2026-10-22 contract; docId comes from the
  fid claim)
- getVersions: GET → DocumentVersionDTO mapped to VersionRecord (adds
  optional createdByUserName; history panel shows it with userId
  fallback)
- getDownloadLink: GET presigned URL (+ ?format=pdf)
- apiClient.toUrl: empty NEXT_PUBLIC_ADDIN_API_BASE_URL = same-origin
  through withBasePath (/docedit/api/...); the env is now only for a
  split deployment (must include basePath, HTTPS)
- documentId/templateId params stay in signatures but are not sent
- tests: versioningService.test.ts covers both modes (real sign-in via
  signInWithTicket, FormData contract assertions, DTO mapping, format
  query, 401 -> AuthRequiredError, demo mock without network)
- docs sync: WORDADDIN-DEV (new "การรันกับ backend จริง" section),
  addin-ui-flow status note, PLAN-DOCVER §8, PLAN-ADDIN-AUTH §12, CLAUDE.md

Verified: tsc clean, 286/286 tests, full E2E against MinIO (ticket ->
token -> upload docx / docx+pdf -> history -> presigned download of both
formats).

Co-Authored-By: Claude Code <noreply@anthropic.com>

wordaddin/models/versionRecord.ts

@@ -32,6 +32,8 @@ export interface VersionRecord {
   /** ISO-8601 */
   createdAt: string;
   createdByUserId: string;
+  /** ชื่อผู้สร้าง — ส่วนเสริมของ DTO กลุ่ม docver (mock/demo อาจไม่มี → UI fallback เป็น userId) */
+  createdByUserName?: string;
   /** SHA256 hex */
   contentHash: string;
   fields: FieldsSnapshot | null;