Add sharing backend: shares CRUD + ACL enforcement everywhere (#16)

- domain: Garden gains a computed MyRole ("owner"/"editor"/"viewer"); new
  ShareWithUser (share + recipient identity); sentinels ErrShareUserNotFound,
  ErrCannotShareWithSelf, ErrShareExists.
- store/shares.go: GetShareRole, ListSharesForGarden (joined with users),
  CreateShare (UNIQUE → ErrShareExists), UpdateShareRole, DeleteShare.
- store/gardens.go: ListGardensForActor returns owned + shared-with-me gardens,
  each carrying my_role (replaces the owner-only list).
- service: requireGardenRole now consults garden_shares (owner implicit, else the
  share's role, else masked ErrNotFound) and stamps MyRole on every read-through.
  UpdateGarden tightened to OWNER-only (editors edit contents, not the garden).
  UpdatePlanting only re-checks plant visibility when the plant is CHANGED, so a
  shared editor can edit a plop that uses the owner's private plant.
- service/shares.go: ListShares/AddShare/UpdateShareRole (owner only), RemoveShare
  (owner or a recipient leaving). AddShare targets an existing account by exact
  email; unknown → 404, self → 400, duplicate → 409.
- api: GET,POST /gardens/:id/shares and PATCH,DELETE /gardens/:id/shares/:userId.

Tests: the full {owner, editor, viewer, stranger} × {read, mutate object, mutate
planting, edit garden, delete garden, manage shares} ACL matrix; shared gardens
carry my_role; AddShare error cases; role upgrade + self-leave; plus a two-user
HTTP flow. The matrix caught the editor-cannot-edit-owner's-plant bug above.

GOWORK=off go build/vet/test ./internal/... green.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/domain/domain.go

@@ -21,6 +21,17 @@ var (
 	// reference it (the FK is ON DELETE RESTRICT). Mapped to 409.
 	ErrPlantInUse = errors.New("plant is referenced by plantings")
 
+	// ErrShareUserNotFound means no account exists for the email a share invite
+	// targeted (v1 shares an existing user only — no invitation emails). Mapped to
+	// 404 with a clear "no account with that email" message.
+	ErrShareUserNotFound = errors.New("no account with that email")
+	// ErrCannotShareWithSelf means the owner tried to share a garden with their
+	// own account. Mapped to 400.
+	ErrCannotShareWithSelf = errors.New("cannot share a garden with yourself")
+	// ErrShareExists means the garden is already shared with that user. Mapped to
+	// 409 (change the existing share's role instead).
+	ErrShareExists = errors.New("garden already shared with that user")
+
 	// ErrInvalidInput means the caller supplied structurally invalid data (empty
 	// required field, malformed value). Mapped to 400.
 	ErrInvalidInput = errors.New("invalid input")
@@ -116,6 +127,10 @@ type Garden struct {
 	Version   int64   `json:"version"`
 	CreatedAt string  `json:"createdAt"`
 	UpdatedAt string  `json:"updatedAt"`
+
+	// MyRole is the requesting actor's effective role on this garden ("owner",
+	// "editor", or "viewer"). Computed by the service, never persisted.
+	MyRole string `json:"myRole,omitempty"`
 }
 
 // GardenShare grants a non-owner user viewer or editor access to a garden.
@@ -130,6 +145,14 @@ type GardenShare struct {
 	UpdatedAt string `json:"updatedAt"`
 }
 
+// ShareWithUser is a garden share plus the target user's identity, for the
+// sharing UI's list (which shows who a garden is shared with).
+type ShareWithUser struct {
+	GardenShare
+	Email       string `json:"email"`
+	DisplayName string `json:"displayName"`
+}
+
 // GardenObject is any placeable object in a garden (bed, container, tree, path…).
 // Positioned by center point + rotation about center, in garden space.
 type GardenObject struct {