Deprecate top-level doc updates (#314)

Removes `/doc/:doc_id/as-update` and `/doc/:doc_id/update` endpoints.

These are convenient endpoints, but prevent us from decoupling the
document management API (metadata) from the documents themselves. This
makes it less flexible to deploy Y-Sweet in architectures where the
document management API (control plane) is intentionally kept apart from
document data (i.e. the data plane).

If a developer is developing against the API and _knows_ they will be
using a single-process Y-Sweet server (i.e. `y-sweet serve`), they can
use the `/d/:doc_id/[as-]update` endpoints (with the server-level bearer
token) to get the same behavior. However, the recommended and documented
approach is not to rely on the `/d/` endpoints directly, and instead hit
the auth endpoint to get the URL for a doc, as that approach is portable
across the standalone, Plane, and Cloudflare versions of Y-Sweet.

crates/y-sweet/src/server.rs

@@ -339,8 +339,8 @@ impl Server {
             .route("/doc/ws/:doc_id", get(handle_socket_upgrade))
             .route("/doc/new", post(new_doc))
             .route("/doc/:doc_id/auth", post(auth_doc))
-            .route("/doc/:doc_id/as-update", get(get_doc_as_update))
-            .route("/doc/:doc_id/update", post(update_doc))
+            .route("/doc/:doc_id/as-update", get(get_doc_as_update_deprecated))
+            .route("/doc/:doc_id/update", post(update_doc_deprecated))
             .route("/d/:doc_id/as-update", get(get_doc_as_update))
             .route("/d/:doc_id/update", post(update_doc))
             .with_state(self.clone())
@@ -435,6 +435,25 @@ async fn get_doc_as_update(
     Ok(update.into_response())
 }
 
+async fn get_doc_as_update_deprecated(
+    Path(doc_id): Path<String>,
+    State(server_state): State<Arc<Server>>,
+    authorization: Option<TypedHeader<headers::Authorization<headers::authorization::Bearer>>>,
+) -> Result<Response, AppError> {
+    tracing::warn!("/doc/:doc_id/as-update is deprecated; call /doc/:doc_id/auth instead and then call as-update on the returned base URL.");
+    get_doc_as_update(State(server_state), Path(doc_id), authorization).await
+}
+
+async fn update_doc_deprecated(
+    Path(doc_id): Path<String>,
+    State(server_state): State<Arc<Server>>,
+    authorization: Option<TypedHeader<headers::Authorization<headers::authorization::Bearer>>>,
+    body: Bytes,
+) -> Result<Response, AppError> {
+    tracing::warn!("/doc/:doc_id/update is deprecated; call /doc/:doc_id/auth instead and then call update on the returned base URL.");
+    update_doc(Path(doc_id), State(server_state), authorization, body).await
+}
+
 async fn get_doc_as_update_single(
     State(server_state): State<Arc<Server>>,
     authorization: Option<TypedHeader<headers::Authorization<headers::authorization::Bearer>>>,