Add pagination to public endpoints, Pangolin site picker, and docs editor toolbar

- Paginate public APIs: campaigns, petitions, shifts, products, pages, shop
- Add safety caps (take limits) to gallery ads, cuts, plans, donation pages
- Add Pangolin connect-site endpoint with .env writer and site ID validation
- Add formatting toolbar + keyboard shortcuts to shared doc editor
- Fix Dockerfile to support su-exec privilege dropping for mounted volumes
- Fix duplicate WebSocket headers in nginx API location block
- Update MkDocs site build and social card assets

Bunker Admin

nginx/conf.d/default.conf.template

@@ -118,7 +118,7 @@ server {
         proxy_set_header Connection "upgrade";
     }
 
-    # API (Express)
+    # API (Express) — includes WebSocket upgrade for docs collaboration
     location /api/ {
         set $upstream_api http://changemaker-v2-api:4000;
         proxy_pass $upstream_api;
@@ -127,7 +127,7 @@ server {
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto $scheme;
 
-        # WebSocket support (docs collaboration)
+        # WebSocket support (docs collaboration via Hocuspocus)
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "upgrade";
     }