fix: CMS dois without custom paths

[isTravis]

CMS-mode communities with a canonical URL set are still depositing *.pubpub.org resource URLs to Crossref. Community which has CMS mode enabled and a canonical URL configured, produces this in its deposit XML:

<doi_data>
  <doi>10.21428/e2259450.27a3a897</doi>
  <resource>https://example.pubpub.org/pub/pubslug</resource>
</doi_data>

Redirecting deposits to the external site is one of the main points of CMS mode, so this makes the feature look broken for its first real user.

Root cause

#3671 wired the Crossref transforms up to the new canonical URL helpers (utils/crossref/transform/pub.js → canonicalPubUrl, and likewise for community.js / collection.js). Those helpers gate on cmsMode:

// utils/canonicalUrls.js
export const canonicalCommunityUrl = (community) => {
	if (community?.cmsMode && community.canonicalBaseUrl) {
		return community.canonicalBaseUrl.replace(/\/+$/, '');
	}
	return communityUrl(community);
};

But findCommunity in server/doi/queries.ts fetches the community with an explicit attribute allow-list, and #3671 added the two new URL columns without adding cmsMode:

attributes: ['id','title','issn','domain','subdomain','citeAs','publishAs',
             'canonicalBaseUrl','canonicalPubUrlTemplate'],   // <- no 'cmsMode'

Sequelize returns undefined for unselected columns rather than erroring, so in the deposit path community.cmsMode is always falsy. The failure is then silent:

1. canonicalPubUrl finds no canonicalPubUrlTemplate, so it takes the
   canonicalBaseUrl branch;
2. that branch does
   url.replace(communityUrl(community), canonicalCommunityUrl(community));
3. canonicalCommunityUrl bails on the falsy cmsMode and returns
   communityUrl(community) — so the replace is a no-op.

Result: the pubpub.org URL, in both the preview XML and an actual submit.

Everything outside the deposit path works, which is why CMS mode looked fine: the pub page's <link rel="canonical">, RSS, citations, and pub connections all get a fully-hydrated community model. And the unit tests in utils/__tests__/cms.test.ts pass because they construct community objects by hand with cmsMode: true — nothing exercised the query layer.

Fix

Add 'cmsMode' to the findCommunity attribute list in server/doi/queries.ts, with a comment explaining why it has to be there.

getDoiData → findCommunity is the single choke point for every deposit path (POST /api/doi, GET /api/doiPreview, setDoiData, and the disconnected/connected relationship passes), so this one line covers pub, collection, and community deposits alike.

Test

Added a regression test in server/doi/__tests__/api.test.ts so a future edit to
that attribute list can't silently break this again. It adds a cmsCommunity
fixture (cmsMode: true, canonicalBaseUrl: "https://cms.example.org") with an
admin and a released pub, previews its DOI, and asserts the deposit contains
https://cms.example.org/pub/<slug> and no pubpub.org. The negative assertion
is safe here: canonicalPubUrl / canonicalCommunityUrl are the only sources of
URLs in a deposit for a fixture with no external publications.

The suite was not run locally — vitest's global setup starts a test Postgres
server that doesn't come up in this environment, and the test script also needs
the firebase CLI. Relying on CI for verification.

Follow-ups (not in this PR)

• cmsMode gating is inconsistent between the two helpers. canonicalCommunityUrl requires cmsMode, but canonicalPubUrl's canonicalPubUrlTemplate branch does not — so setting only the Pub URL template redirects pub URLs on a non-CMS community while collection and community URLs stay on pubpub.org. Worth deciding whether cmsMode should gate canonical URLs at all, or whether the presence of canonicalBaseUrl should be sufficient on its own.