Sharing backend: shares CRUD + ACL enforcement everywhere (#16)

Co-authored-by: Steve Dudenhoeffer <[email protected]>

internal/api/api.go

@@ -84,6 +84,12 @@ func New(cfg *config.Config, svc *service.Service) *gin.Engine {
 	gardens.GET("/:id/full", h.getGardenFull) // one-shot editor load
 	gardens.POST("/:id/objects", h.createObject)
 
+	// Sharing (owner-managed; a recipient may remove their own share).
+	gardens.GET("/:id/shares", h.listShares)
+	gardens.POST("/:id/shares", h.addShare)
+	gardens.PATCH("/:id/shares/:userId", h.updateShare)
+	gardens.DELETE("/:id/shares/:userId", h.removeShare)
+
 	// Objects are addressed by their own id; the service resolves the owning
 	// garden for the permission check.
 	objects := v1.Group("/objects", h.requireAuth())