Refactor ticket verification and installation scripts

- Split `verifyAddinTicket` into two functions: `verifyAddinTicketHmac` (ignores expiration) and `verifyAddinTicket` (checks expiration).
- Add `hasVersionByUser` function to check if a document has been previously worked on by a user, allowing expired tickets to be accepted if the user has a history with the document.
- Update OpenAPI specification to reflect changes in ticket expiration handling.
- Introduce new scripts for installing and uninstalling the Word add-in on Windows and macOS, providing a streamlined process for sideloading the add-in.
- Enhance tests for ticket verification to cover new functionality regarding expired tickets and user history.

tests/lib/addin-ticket.test.ts

@@ -6,6 +6,7 @@ import {
   parseTicketTokenBody,
   ticketToDocverClaims,
   verifyAddinTicket,
+  verifyAddinTicketHmac,
 } from "@/lib/addin-ticket";
 
 // PLAN-ADDIN-AUTH.md §3 — pure ล้วน (verifyAddinTicket รับ secret ทาง parameter)
@@ -73,6 +74,26 @@ describe("verifyAddinTicket", () => {
   });
 });
 
+// verifyAddinTicketHmac = ตัวเดียวกันแต่ไม่ตรวจ exp — route ใช้ตรวจ HMAC ก่อน
+// แล้วตัดสิน "ticket หมดอายุ + เอกสารนี้เคยทำงานโดย uid เดียวกัน" จาก DB เอง
+// (requirement ขั้น 7 — แก้บั๊ก 2026-10-28)
+describe("verifyAddinTicketHmac", () => {
+  it("exp อดีต + HMAC ถูก = ผ่าน (ได้ ticket ครบ) — ต่างจาก verifyAddinTicket ที่ไม่ผ่าน", () => {
+    const expired = JSON.stringify({ exp: 1, fid: "f", uid: "u", uname: "n" });
+    const hmacResult = verifyAddinTicketHmac(expired, sign(expired), SECRET);
+    ok(hmacResult);
+    expect(hmacResult.ticket.uid).toBe("u");
+    expect(verifyAddinTicket(expired, sign(expired), SECRET).ok).toBe(false);
+  });
+
+  it("HMAC ผิด / digest รูปเพี้ยน / ticket ผิดกติกา = ไม่ผ่านเหมือนเดิม (แม้ exp ยังไม่หมด)", () => {
+    expect(verifyAddinTicketHmac(TICKET_DATA, sign(TICKET_DATA, "wrong-secret"), SECRET).ok).toBe(false);
+    expect(verifyAddinTicketHmac(TICKET_DATA, "zz".repeat(32), SECRET).ok).toBe(false);
+    const extra = JSON.stringify({ exp: Math.floor(Date.now() / 1000) + 60, fid: "f", uid: "u", uname: "n", oops: 1 });
+    expect(verifyAddinTicketHmac(extra, sign(extra), SECRET).ok).toBe(false);
+  });
+});
+
 describe("ticketToDocverClaims", () => {
   it("แปลง uid→userid, uname→username, tid→template · tid ไม่มี = null", () => {
     expect(