Public read-only share link (#41)

A per-garden public link anyone can open read-only, with no login and no OIDC.

Backend:
- Migration 0004 adds gardens.public_token (nullable, unique over non-NULL).
- Owner-only management: GET/POST/DELETE /gardens/:id/share-link (state /
  enable-or-rotate / disable). The token is stored raw (it must be shown back
  to the owner) and never selected into the normal garden payload.
- Unauthenticated GET /api/v1/public/gardens/:token returns the read-only /full
  payload — the token is the capability, so no requireAuth and no redirect. The
  public view drops MyRole and OwnerID to minimize what an anonymous viewer
  learns. Unknown/rotated/disabled tokens are masked as 404.
- assembleFull is extracted from GardenFull so both reads return one shape.

Frontend:
- /g/$token route with NO auth guard (SPA fallback already serves it), rendering
  GardenCanvas read-only via usePublicGarden.
- Share dialog gains a Public link section: create, copy, regenerate, turn off.

Tests: service lifecycle + ACL (owner-only, non-owner masked, rotate/disable
invalidation) and the HTTP surface incl. the cookieless public read.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/api/public.go

@@ -0,0 +1,68 @@
+package api
+
+import (
+	"net/http"
+
+	"github.com/gin-gonic/gin"
+)
+
+// getPublicGarden serves the read-only /full payload for a garden addressed by a
+// public share token. It sits OUTSIDE requireAuth — the token itself is the
+// capability — so a logged-out visitor can open a shared link without ever being
+// bounced to /login or the OIDC flow. An unknown or disabled token is a 404.
+func (h *handlers) getPublicGarden(c *gin.Context) {
+	full, err := h.svc.PublicGarden(c.Request.Context(), c.Param("token"))
+	if err != nil {
+		writeServiceError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, full)
+}
+
+// getShareLink reports the garden's public-link state (and, to the owner, the
+// current token) so the share dialog can show/copy the URL. Owner only.
+func (h *handlers) getShareLink(c *gin.Context) {
+	id, ok := parseIDParam(c, "id")
+	if !ok {
+		return
+	}
+	link, err := h.svc.GetPublicShareLink(c.Request.Context(), mustActor(c).ID, id)
+	if err != nil {
+		writeServiceError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, link)
+}
+
+// createShareLink enables the public link (idempotent) or, with {"rotate":true},
+// issues a fresh token that invalidates the previous URL. Owner only. The body is
+// optional — a missing/malformed one just means enable-without-rotate.
+func (h *handlers) createShareLink(c *gin.Context) {
+	id, ok := parseIDParam(c, "id")
+	if !ok {
+		return
+	}
+	var req struct {
+		Rotate bool `json:"rotate"`
+	}
+	_ = c.ShouldBindJSON(&req)
+	link, err := h.svc.EnablePublicShareLink(c.Request.Context(), mustActor(c).ID, id, req.Rotate)
+	if err != nil {
+		writeServiceError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, link)
+}
+
+// deleteShareLink disables the public link. Owner only; idempotent.
+func (h *handlers) deleteShareLink(c *gin.Context) {
+	id, ok := parseIDParam(c, "id")
+	if !ok {
+		return
+	}
+	if err := h.svc.DisablePublicShareLink(c.Request.Context(), mustActor(c).ID, id); err != nil {
+		writeServiceError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"enabled": false})
+}