docs(plan): Owner-Passwort für geteilte Pläne als geplant eingetragen (#col.live.owner)

Beim Anlegen einmalig vom Server geliefert, Browser hält eine Kopie, keine
Recovery auf fremdem Browser; Verwaltung bindet künftig daran, ein Admin
mit Master-Passwort kann reclaimen. Nur Plan-Eintrag, noch keine Umsetzung.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

docs/examples/werkbaum.werkbaum

@@ -153,6 +153,7 @@
       - [^] #col.live.ask: On a real overlap, ask whose version wins (S)
       - [^] #col.live.upload: Share: put a local plan on the server (S)  %% a button in the editor title bar, see D81
       - [?] #col.live.cursors: Cursors and who else is here (S)
+      - [ ] #col.live.owner: An owner password guards managing a shared plan (M)  %% returned once on creation, admin can reclaim
       - [-] #col.live.ws: Transport over a websocket (S)  %% plain HTTP turned out to be enough
       - [-] #col.live.own: A merge algorithm of our own (XL)  %% solved problem, do not reinvent
   - [?] #mmd: Mermaid plugin (XL)
@@ -910,6 +911,13 @@
   their only copy to a server should not lose it in the act. The picker names
   the host beside a server document, so the two entries are told apart.
 
+#col.live.owner
+  Today the unguessable link is the only guard, so holding it means holding
+  everything, delete included. Creating a document shall return an owner
+  password once — save it, the browser keeps a copy, there is no recovery on
+  another browser. Management actions bind to it; an admin with the master
+  password can still reclaim a document.
+
 #col.live.cursors
   Seeing where the others are. A by-product of the merge layer rather than a
   feature in its own right.