Public read-only share link (#41)

A per-garden public link anyone can open read-only, with no login and no OIDC.

Backend:
- Migration 0004 adds gardens.public_token (nullable, unique over non-NULL).
- Owner-only management: GET/POST/DELETE /gardens/:id/share-link (state /
  enable-or-rotate / disable). The token is stored raw (it must be shown back
  to the owner) and never selected into the normal garden payload.
- Unauthenticated GET /api/v1/public/gardens/:token returns the read-only /full
  payload — the token is the capability, so no requireAuth and no redirect. The
  public view drops MyRole and OwnerID to minimize what an anonymous viewer
  learns. Unknown/rotated/disabled tokens are masked as 404.
- assembleFull is extracted from GardenFull so both reads return one shape.

Frontend:
- /g/$token route with NO auth guard (SPA fallback already serves it), rendering
  GardenCanvas read-only via usePublicGarden.
- Share dialog gains a Public link section: create, copy, regenerate, turn off.

Tests: service lifecycle + ACL (owner-only, non-owner masked, rotate/disable
invalidation) and the HTTP surface incl. the cookieless public read.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/service/service.go

@@ -59,16 +59,25 @@ func formatTime(t time.Time) string { return t.UTC().Format(timeLayout) }
 // parseTime parses a canonical pansy timestamp.
 func parseTime(s string) (time.Time, error) { return time.Parse(timeLayout, s) }
 
-// newSessionToken returns a fresh URL-safe random bearer token (32 bytes of
-// entropy). The raw token goes in the cookie; only its hash is persisted.
-func newSessionToken() (string, error) {
-	b := make([]byte, 32)
+// randToken returns nBytes of cryptographic randomness as a URL-safe string.
+func randToken(nBytes int) (string, error) {
+	b := make([]byte, nBytes)
 	if _, err := rand.Read(b); err != nil {
-		return "", fmt.Errorf("service: generate session token: %w", err)
+		return "", fmt.Errorf("service: generate token: %w", err)
 	}
 	return base64.RawURLEncoding.EncodeToString(b), nil
 }
 
+// newSessionToken returns a fresh URL-safe random bearer token (32 bytes of
+// entropy). The raw token goes in the cookie; only its hash is persisted.
+func newSessionToken() (string, error) { return randToken(32) }
+
+// newPublicToken returns a fresh unguessable token for a garden's public share
+// link (18 bytes → 144 bits; a 24-char URL segment). Unlike a session token it's
+// stored raw (it must be shown back to the owner to copy) and grants only
+// read-only access to one garden.
+func newPublicToken() (string, error) { return randToken(18) }
+
 // hashToken maps a raw bearer token to the hex sha256 stored as the session's
 // primary key.
 func hashToken(raw string) string {