hub-client: simplify the per-keystroke attribution update

[shikokuchuo]

• The refresh path was doing redundant work on every cycle: it asked Automerge for a topologically-sorted dump of the document's full history, then cross-referenced that against the list of new changes to figure out which ones to apply.
• Automerge's getChanges API already returns exactly that list — only the new changes, in the right order — in a single call. This PR uses it directly and drops the history scan.
• The cost of the dropped scan scaled with the document's total edit history, so the longest-running collaboration sessions were the ones paying the most for the duplicated work.
• New tests pin the invariant that the incremental refresh always agrees with a from-scratch rebuild — covering concurrent merges, interleaved local-and-remote edits, and the case where nothing has changed since the last cycle.