Public read-only share link (#41)

A per-garden public link anyone can open read-only, with no login and no OIDC.

Backend:
- Migration 0004 adds gardens.public_token (nullable, unique over non-NULL).
- Owner-only management: GET/POST/DELETE /gardens/:id/share-link (state /
  enable-or-rotate / disable). The token is stored raw (it must be shown back
  to the owner) and never selected into the normal garden payload.
- Unauthenticated GET /api/v1/public/gardens/:token returns the read-only /full
  payload — the token is the capability, so no requireAuth and no redirect. The
  public view drops MyRole and OwnerID to minimize what an anonymous viewer
  learns. Unknown/rotated/disabled tokens are masked as 404.
- assembleFull is extracted from GardenFull so both reads return one shape.

Frontend:
- /g/$token route with NO auth guard (SPA fallback already serves it), rendering
  GardenCanvas read-only via usePublicGarden.
- Share dialog gains a Public link section: create, copy, regenerate, turn off.

Tests: service lifecycle + ACL (owner-only, non-owner masked, rotate/disable
invalidation) and the HTTP surface incl. the cookieless public read.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/api/api.go

@@ -90,6 +90,13 @@ func New(cfg *config.Config, svc *service.Service) *gin.Engine {
 	gardens.PATCH("/:id/shares/:userId", h.updateShare)
 	gardens.DELETE("/:id/shares/:userId", h.removeShare)
 
+	// Public read-only share link (owner-managed): GET reports state, POST
+	// enables/rotates, DELETE disables. The link itself is served unauthenticated
+	// below.
+	gardens.GET("/:id/share-link", h.getShareLink)
+	gardens.POST("/:id/share-link", h.createShareLink)
+	gardens.DELETE("/:id/share-link", h.deleteShareLink)
+
 	// Objects are addressed by their own id; the service resolves the owning
 	// garden for the permission check.
 	objects := v1.Group("/objects", h.requireAuth())
@@ -110,6 +117,13 @@ func New(cfg *config.Config, svc *service.Service) *gin.Engine {
 	plants.PATCH("/:id", h.updatePlant)
 	plants.DELETE("/:id", h.deletePlant)
 
+	// Public, unauthenticated read of a garden by its share token. Deliberately
+	// NOT behind requireAuth: the token is the capability, so a logged-out visitor
+	// opens a shared link without being redirected to /login or OIDC. Only GET,
+	// only the read-only /full payload — never a mutation.
+	public := v1.Group("/public")
+	public.GET("/gardens/:token", h.getPublicGarden)
+
 	return r
 }