Add sharing backend: shares CRUD + ACL enforcement everywhere (#16)

- domain: Garden gains a computed MyRole ("owner"/"editor"/"viewer"); new
  ShareWithUser (share + recipient identity); sentinels ErrShareUserNotFound,
  ErrCannotShareWithSelf, ErrShareExists.
- store/shares.go: GetShareRole, ListSharesForGarden (joined with users),
  CreateShare (UNIQUE → ErrShareExists), UpdateShareRole, DeleteShare.
- store/gardens.go: ListGardensForActor returns owned + shared-with-me gardens,
  each carrying my_role (replaces the owner-only list).
- service: requireGardenRole now consults garden_shares (owner implicit, else the
  share's role, else masked ErrNotFound) and stamps MyRole on every read-through.
  UpdateGarden tightened to OWNER-only (editors edit contents, not the garden).
  UpdatePlanting only re-checks plant visibility when the plant is CHANGED, so a
  shared editor can edit a plop that uses the owner's private plant.
- service/shares.go: ListShares/AddShare/UpdateShareRole (owner only), RemoveShare
  (owner or a recipient leaving). AddShare targets an existing account by exact
  email; unknown → 404, self → 400, duplicate → 409.
- api: GET,POST /gardens/:id/shares and PATCH,DELETE /gardens/:id/shares/:userId.

Tests: the full {owner, editor, viewer, stranger} × {read, mutate object, mutate
planting, edit garden, delete garden, manage shares} ACL matrix; shared gardens
carry my_role; AddShare error cases; role upgrade + self-leave; plus a two-user
HTTP flow. The matrix caught the editor-cannot-edit-owner's-plant bug above.

GOWORK=off go build/vet/test ./internal/... green.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/service/gardens.go

@@ -32,6 +32,20 @@ const (
 	roleOwner
 )
 
+// String renders a role for the API's Garden.MyRole ("owner"/"editor"/"viewer").
+func (r gardenRole) String() string {
+	switch r {
+	case roleOwner:
+		return "owner"
+	case roleEditor:
+		return domain.RoleEditor
+	case roleViewer:
+		return domain.RoleViewer
+	default:
+		return ""
+	}
+}
+
 // GardenInput is the mutable field set for creating or updating a garden.
 type GardenInput struct {
 	Name     string
@@ -54,23 +68,41 @@ func (s *Service) requireGardenRole(ctx context.Context, actorID, gardenID int64
 	if err != nil {
 		return nil, err // ErrNotFound or a real error
 	}
-	role := effectiveGardenRole(actorID, g)
+	role, err := s.effectiveGardenRole(ctx, actorID, g)
+	if err != nil {
+		return nil, err
+	}
 	if role == roleNone {
 		return nil, domain.ErrNotFound
 	}
 	if role < min {
 		return nil, domain.ErrForbidden
 	}
+	g.MyRole = role.String() // so every read-through carries the actor's role
 	return g, nil
 }
 
-// effectiveGardenRole is the actor's role on a garden. Owner is implicit via
-// gardens.owner_id; share-based viewer/editor roles are added in #16.
-func effectiveGardenRole(actorID int64, g *domain.Garden) gardenRole {
+// effectiveGardenRole is the actor's role on a garden: owner (implicit via
+// gardens.owner_id), else a viewer/editor grant from garden_shares, else none.
+func (s *Service) effectiveGardenRole(ctx context.Context, actorID int64, g *domain.Garden) (gardenRole, error) {
 	if g.OwnerID == actorID {
-		return roleOwner
+		return roleOwner, nil
+	}
+	role, found, err := s.store.GetShareRole(ctx, g.ID, actorID)
+	if err != nil {
+		return roleNone, err
+	}
+	if !found {
+		return roleNone, nil
+	}
+	switch role {
+	case domain.RoleEditor:
+		return roleEditor, nil
+	case domain.RoleViewer:
+		return roleViewer, nil
+	default:
+		return roleNone, nil
 	}
-	return roleNone
 }
 
 // CreateGarden creates a garden owned by the actor. Missing dimensions default
@@ -81,7 +113,12 @@ func (s *Service) CreateGarden(ctx context.Context, actorID int64, in GardenInpu
 		return nil, err
 	}
 	g.OwnerID = actorID
-	return s.store.CreateGarden(ctx, g)
+	created, err := s.store.CreateGarden(ctx, g)
+	if err != nil {
+		return nil, err
+	}
+	created.MyRole = roleOwner.String() // the creator owns it
+	return created, nil
 }
 
 // GetGarden returns a garden the actor may at least view.
@@ -89,16 +126,18 @@ func (s *Service) GetGarden(ctx context.Context, actorID, gardenID int64) (*doma
 	return s.requireGardenRole(ctx, actorID, gardenID, roleViewer)
 }
 
-// ListGardens returns the gardens the actor can see. Owned-only until #16.
+// ListGardens returns the gardens the actor can see: owned plus shared-with-them,
+// each row carrying the actor's my_role.
 func (s *Service) ListGardens(ctx context.Context, actorID int64) ([]domain.Garden, error) {
-	return s.store.ListGardensForOwner(ctx, actorID)
+	return s.store.ListGardensForActor(ctx, actorID)
 }
 
-// UpdateGarden applies a version-guarded update; the actor must be at least an
-// editor. On a version mismatch it returns (current garden, ErrVersionConflict)
-// so the handler can return the fresh row for the client to rebase.
+// UpdateGarden applies a version-guarded update to a garden's metadata; only the
+// OWNER may edit metadata (editors edit contents, not the garden itself). On a
+// version mismatch it returns (current garden, ErrVersionConflict) so the handler
+// can return the fresh row for the client to rebase.
 func (s *Service) UpdateGarden(ctx context.Context, actorID, gardenID int64, in GardenInput, version int64) (*domain.Garden, error) {
-	if _, err := s.requireGardenRole(ctx, actorID, gardenID, roleEditor); err != nil {
+	if _, err := s.requireGardenRole(ctx, actorID, gardenID, roleOwner); err != nil {
 		return nil, err
 	}
 	g, err := gardenFromInput(in, false) // no defaults: an update states every field
@@ -107,7 +146,11 @@ func (s *Service) UpdateGarden(ctx context.Context, actorID, gardenID int64, in
 	}
 	g.ID = gardenID
 	g.Version = version
-	return s.store.UpdateGarden(ctx, g)
+	updated, err := s.store.UpdateGarden(ctx, g)
+	if updated != nil {
+		updated.MyRole = roleOwner.String() // only the owner reaches here
+	}
+	return updated, err
 }
 
 // DeleteGarden removes a garden; only the owner may.