feat(publisher): editor quick-link for signed-in editors

The published article and the editor share the same Space, but a
visitor who already has edit rights had no way to jump from one
to the other without retyping \`/editor\` in the URL bar. Add a
small pencil icon top-right, mirroring the existing theme toggle
on the top-left, that links to /editor.

Visibility:
- Hidden by default (\`<a id="edit-link" ... hidden>\`) so non-
editors / anonymous visitors never see a flash.
- An inline script probes \`/api/auth/status\` on load and removes
the \`hidden\` attribute when \`canEdit\` is true. Fetch failures
(offline preview, exported HTML opened from disk, etc.) are
silently swallowed - the button just stays hidden.
- Hidden under 1100px (same breakpoint as the theme toggle) so
mobile / tablet layouts aren't cluttered.

Styling: matches the theme toggle (40px circle, page-bg fill,
1px border, soft shadow) so the page stays balanced visually.
\`mix(--primary-color)\` tint on hover hints at the destination.

Snapshot updated to reflect the new markup + script block.

Co-authored-by: Cursor <cursoragent@cursor.com>

backend/src/publisher/html-renderer.ts

@@ -197,6 +197,19 @@ ${renderPrimaryColorOverride(meta.primaryHue)}
     </span>
   </button>
 
+  <!--
+    Quick link to the editor, shown only for visitors whose
+    /api/auth/status response carries canEdit=true. Hidden by
+    default so non-editors never see a flash. Same shape as the
+    theme toggle, mirrored to the right edge of the viewport.
+  -->
+  <a id="edit-link" href="/editor" aria-label="Open the editor" title="Open the editor" hidden>
+    <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+      <path d="M12 20h9"/>
+      <path d="M16.5 3.5a2.121 2.121 0 0 1 3 3L7 19l-4 1 1-4L16.5 3.5z"/>
+    </svg>
+  </a>
+
   <!-- Mobile TOC toggle -->
   <button class="toc-mobile-toggle" aria-label="Open table of contents" aria-expanded="false">
     <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
@@ -698,6 +711,30 @@ ${renderPrimaryColorOverride(meta.primaryHue)}
       if (h) { var t = document.querySelector(h); if (t) t.scrollIntoView({block:'start'}); }
       else window.scrollTo({top:0});
     });
+
+    // ----------------------------------------------------------------
+    // Editor quick-link
+    // ----------------------------------------------------------------
+    // The published page lives on the same Space as the editor, so we
+    // can probe /api/auth/status to know if the current visitor has
+    // edit rights. When they do, surface a small "open editor" pencil
+    // top-right; otherwise the button stays \`hidden\` and is removed
+    // on the next layout pass (no flicker for read-only visitors).
+    //
+    // A network failure (offline preview, exported HTML opened from
+    // disk, ...) is silently ignored - the button just stays hidden.
+    (function() {
+      var link = document.getElementById('edit-link');
+      if (!link) return;
+      fetch('/api/auth/status', { credentials: 'same-origin' })
+        .then(function(r) { return r.ok ? r.json() : null; })
+        .then(function(data) {
+          if (data && data.canEdit) {
+            link.removeAttribute('hidden');
+          }
+        })
+        .catch(function() {});
+    })();
   })();
   </script>
 </body>

backend/tests/__snapshots__/html-renderer-snapshot.test.ts.snap

@@ -125,6 +125,19 @@ exports[`snapshot - full render > matches snapshot for a typical article 1`] = `
     </span>
   </button>
 
+  <!--
+    Quick link to the editor, shown only for visitors whose
+    /api/auth/status response carries canEdit=true. Hidden by
+    default so non-editors never see a flash. Same shape as the
+    theme toggle, mirrored to the right edge of the viewport.
+  -->
+  <a id="edit-link" href="/editor" aria-label="Open the editor" title="Open the editor" hidden>
+    <svg width="18" height="18" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" aria-hidden="true">
+      <path d="M12 20h9"/>
+      <path d="M16.5 3.5a2.121 2.121 0 0 1 3 3L7 19l-4 1 1-4L16.5 3.5z"/>
+    </svg>
+  </a>
+
   <!-- Mobile TOC toggle -->
   <button class="toc-mobile-toggle" aria-label="Open table of contents" aria-expanded="false">
     <svg width="20" height="20" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round">
@@ -641,6 +654,30 @@ exports[`snapshot - full render > matches snapshot for a typical article 1`] = `
       if (h) { var t = document.querySelector(h); if (t) t.scrollIntoView({block:'start'}); }
       else window.scrollTo({top:0});
     });
+
+    // ----------------------------------------------------------------
+    // Editor quick-link
+    // ----------------------------------------------------------------
+    // The published page lives on the same Space as the editor, so we
+    // can probe /api/auth/status to know if the current visitor has
+    // edit rights. When they do, surface a small "open editor" pencil
+    // top-right; otherwise the button stays \`hidden\` and is removed
+    // on the next layout pass (no flicker for read-only visitors).
+    //
+    // A network failure (offline preview, exported HTML opened from
+    // disk, ...) is silently ignored - the button just stays hidden.
+    (function() {
+      var link = document.getElementById('edit-link');
+      if (!link) return;
+      fetch('/api/auth/status', { credentials: 'same-origin' })
+        .then(function(r) { return r.ok ? r.json() : null; })
+        .then(function(data) {
+          if (data && data.canEdit) {
+            link.removeAttribute('hidden');
+          }
+        })
+        .catch(function() {});
+    })();
   })();
   </script>
 </body>

frontend/src/styles/_layout.css

@@ -138,8 +138,44 @@
   transform: scale(0.92);
 }
 
+/* Editor quick-link (published page only). Mirrors the theme toggle
+   on the opposite side. The button itself ships with `hidden` and is
+   revealed by inline JS in the published page only when
+   /api/auth/status returns canEdit=true. */
+#edit-link {
+  position: absolute;
+  top: var(--spacing-4);
+  right: var(--spacing-4);
+  margin: 0;
+  z-index: var(--z-overlay);
+  width: 40px;
+  height: 40px;
+  border-radius: 50%;
+  border: 1px solid var(--border-color);
+  background: var(--page-bg);
+  box-shadow: 0 2px 12px rgba(0,0,0,.08);
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  padding: 0;
+  color: var(--text-color);
+  text-decoration: none;
+  transition: transform 150ms ease, box-shadow 150ms ease,
+    background 150ms ease;
+}
+#edit-link:hover {
+  background: color-mix(in srgb, var(--primary-color) 12%, var(--page-bg));
+}
+#edit-link:active {
+  transform: scale(0.92);
+}
+#edit-link[hidden] {
+  display: none;
+}
+
 @media (max-width: 1100px) {
-  #theme-toggle {
+  #theme-toggle,
+  #edit-link {
     display: none;
   }
 }