revisions: a save keeps what it replaces

Every write of a document's text keeps the text it replaces, in the same
transaction. Autosave writes every few seconds, so an ordinary save keeps
one at most every ten minutes; `:w!`, a save over the SFTP mount and a
restore always keep one, because each may undo something. A rename alone,
or a document that was empty, keeps nothing.

`gh` or `:history` lists the open document's earlier versions, the newest
first, and shows the highlighted one as a line diff against the text as it
is now. Enter brings it back, and what it replaces becomes a version of
its own, so a restore is undone the same way.

The daily sweep forgets versions older than WORKSPACE_REVISION_DAYS (90)
but never the newest 20 of a document, and keeps an upload as long as a
version still embeds it. Versions stay out of the export, the mount and
the readable mirror; a document in the trash shows none.

.env.example

@@ -108,3 +108,7 @@ WORKSPACE_VAULT_IDLE_MIN=15
 # Days a deleted document, folder, file or space waits in the trash, where
 # :trash can bring it back, before it and its files are deleted for good.
 WORKSPACE_TRASH_DAYS=30
+
+# Days a document's earlier versions are kept for :history. The newest 20 of
+# every document are kept however old they are.
+WORKSPACE_REVISION_DAYS=90