refactor(bridge): encapsulate DocumentState fields behind constructor and accessors

[bug-ops]

Summary

• DocumentState (crates/mcpls-core/src/bridge/state.rs) previously exposed all six fields as pub with no constructor, letting any caller inside bridge::state violate its documented invariants (monotonic version, disk provenance, per-server synced tracking) by writing fields directly.
• Fields are now private. A constructor and internal mutators (apply_local_edit, commit_reload, set_disk, mark_synced, forget_server) enforce those invariants; read access goes through #[must_use] getters (uri(), language_id(), version(), content(), synced_version()).
• No public disk() getter — would leak the crate-internal DiskSync type.
• Pure encapsulation refactor: no behavior change. DocumentTracker's only constructor takes ResourceLimits, which is not re-exported outside bridge::state, so DocumentState/DocumentTracker were already unreachable from outside the crate before this change — the CHANGELOG entry reflects that this is an internal improvement, not an externally-breaking API change.

Test plan

• cargo +nightly fmt --all -- --check
• cargo clippy --all-targets --all-features --workspace -- -D warnings
• cargo nextest run --workspace --all-features --lib --bins (642/642 passed)
• RUSTFLAGS="-D warnings" RUSTDOCFLAGS="--deny rustdoc::broken_intra_doc_links" cargo doc --no-deps --workspace
• Existing test assertions migrated to exercise the new getters directly, so the accessor contract is validated rather than only the private fields

Closes #304