feat: lock pages against editor changes

Administrators can lock a page from the Pages list to stop editors
publishing, saving a draft, or scheduling a change to it. Administrators
are never restricted by a lock. State is stored per-page URI in the new
cms/data/pagelocks.json, following the existing pagetemplates.json
pattern: it moves with the page on rename, is cleared on delete, and is
never copied onto a duplicate.

- New lockPageAction and assertNotLockedForEditor() guard, called from
  save/saveDraft/schedule.
- getPages responses gain a locked flag; the Pages list gets a Lock/
  Unlock row action and a Locked badge.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

docs/ARCHITECTURE.md

@@ -58,6 +58,7 @@ Published content stays in the web document root. NeoCMS stores supporting data
 | `menus.json` | Named menus: `{key: {items: [{label, url, parent}], updated, title?}}`; seeded by the site scan, never created by the CMS. |
 | `newpages.json` | Pending (unpublished) pages: title, chosen menu, template, author, created. |
 | `pagetemplates.json` | Pages offered as templates in the New page section of Pages. |
+| `pagelocks.json` | Pages an administrator has locked against editor changes. |
 | `users.json` | CMS-created accounts and profile overlays for config accounts (`{users: {...}, profiles: {...}}`). |
 | `media.json` | Per-file description (alt text or link text), original filename, and uploader. |
 | `activity.json` | The latest 250 dashboard activity entries. |