Add sharing backend: shares CRUD + ACL enforcement everywhere (#16)

- domain: Garden gains a computed MyRole ("owner"/"editor"/"viewer"); new
  ShareWithUser (share + recipient identity); sentinels ErrShareUserNotFound,
  ErrCannotShareWithSelf, ErrShareExists.
- store/shares.go: GetShareRole, ListSharesForGarden (joined with users),
  CreateShare (UNIQUE → ErrShareExists), UpdateShareRole, DeleteShare.
- store/gardens.go: ListGardensForActor returns owned + shared-with-me gardens,
  each carrying my_role (replaces the owner-only list).
- service: requireGardenRole now consults garden_shares (owner implicit, else the
  share's role, else masked ErrNotFound) and stamps MyRole on every read-through.
  UpdateGarden tightened to OWNER-only (editors edit contents, not the garden).
  UpdatePlanting only re-checks plant visibility when the plant is CHANGED, so a
  shared editor can edit a plop that uses the owner's private plant.
- service/shares.go: ListShares/AddShare/UpdateShareRole (owner only), RemoveShare
  (owner or a recipient leaving). AddShare targets an existing account by exact
  email; unknown → 404, self → 400, duplicate → 409.
- api: GET,POST /gardens/:id/shares and PATCH,DELETE /gardens/:id/shares/:userId.

Tests: the full {owner, editor, viewer, stranger} × {read, mutate object, mutate
planting, edit garden, delete garden, manage shares} ACL matrix; shared gardens
carry my_role; AddShare error cases; role upgrade + self-leave; plus a two-user
HTTP flow. The matrix caught the editor-cannot-edit-owner's-plant bug above.

GOWORK=off go build/vet/test ./internal/... green.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/store/gardens.go

@@ -23,7 +23,20 @@ func scanGarden(s scanner) (*domain.Garden, error) {
 	return &g, nil
 }
 
-// maxGardensListed caps ListGardensForOwner as a defensive backstop against a
+// scanGardenWithRole reads a garden row plus a trailing my_role column into the
+// computed Garden.MyRole field (used by the actor-scoped list).
+func scanGardenWithRole(s scanner) (*domain.Garden, error) {
+	var g domain.Garden
+	if err := s.Scan(
+		&g.ID, &g.OwnerID, &g.Name, &g.WidthCM, &g.HeightCM,
+		&g.UnitPref, &g.Notes, &g.Version, &g.CreatedAt, &g.UpdatedAt, &g.MyRole,
+	); err != nil {
+		return nil, err
+	}
+	return &g, nil
+}
+
+// maxGardensListed caps the gardens list as a defensive backstop against a
 // pathologically large result. At household scale a user has a handful of
 // gardens, so this is never hit; genuine pagination is post-v1 if ever needed.
 const maxGardensListed = 1000
@@ -56,13 +69,21 @@ func (d *DB) GetGarden(ctx context.Context, id int64) (*domain.Garden, error) {
 	return g, nil
 }
 
-// ListGardensForOwner returns the gardens owned by ownerID, newest first. The
-// slice is always non-nil (an empty list, not null). Shared-with-me gardens are
-// added in #16.
-func (d *DB) ListGardensForOwner(ctx context.Context, ownerID int64) ([]domain.Garden, error) {
+// ListGardensForActor returns the gardens an actor can see — those they own
+// (my_role "owner") plus those shared with them (my_role = the share's role) —
+// newest first. Always a non-nil slice.
+func (d *DB) ListGardensForActor(ctx context.Context, actorID int64) ([]domain.Garden, error) {
 	rows, err := d.sql.QueryContext(ctx,
-		`SELECT `+gardenColumns+` FROM gardens WHERE owner_id = ? ORDER BY created_at DESC, id DESC LIMIT ?`,
-		ownerID, maxGardensListed,
+		`SELECT `+gardenColumns+`, my_role FROM (
+		     SELECT `+gardenColumns+`, 'owner' AS my_role FROM gardens WHERE owner_id = ?
+		     UNION ALL
+		     SELECT `+qualifyColumns("g", gardenColumns)+`, s.role AS my_role
+		       FROM gardens g JOIN garden_shares s ON s.garden_id = g.id
+		      WHERE s.user_id = ?
+		 )
+		 ORDER BY created_at DESC, id DESC
+		 LIMIT ?`,
+		actorID, actorID, maxGardensListed,
 	)
 	if err != nil {
 		return nil, fmt.Errorf("store: list gardens: %w", err)
@@ -71,7 +92,7 @@ func (d *DB) ListGardensForOwner(ctx context.Context, ownerID int64) ([]domain.G
 
 	gardens := []domain.Garden{}
 	for rows.Next() {
-		g, err := scanGarden(rows)
+		g, err := scanGardenWithRole(rows)
 		if err != nil {
 			return nil, fmt.Errorf("store: scan garden: %w", err)
 		}