Public read-only share link (#41)

A per-garden public link anyone can open read-only, with no login and no OIDC.

Backend:
- Migration 0004 adds gardens.public_token (nullable, unique over non-NULL).
- Owner-only management: GET/POST/DELETE /gardens/:id/share-link (state /
  enable-or-rotate / disable). The token is stored raw (it must be shown back
  to the owner) and never selected into the normal garden payload.
- Unauthenticated GET /api/v1/public/gardens/:token returns the read-only /full
  payload — the token is the capability, so no requireAuth and no redirect. The
  public view drops MyRole and OwnerID to minimize what an anonymous viewer
  learns. Unknown/rotated/disabled tokens are masked as 404.
- assembleFull is extracted from GardenFull so both reads return one shape.

Frontend:
- /g/$token route with NO auth guard (SPA fallback already serves it), rendering
  GardenCanvas read-only via usePublicGarden.
- Share dialog gains a Public link section: create, copy, regenerate, turn off.

Tests: service lifecycle + ACL (owner-only, non-owner masked, rotate/disable
invalidation) and the HTTP surface incl. the cookieless public read.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

internal/store/gardens.go

@@ -153,3 +153,63 @@ func (d *DB) DeleteGarden(ctx context.Context, id int64) error {
 	}
 	return nil
 }
+
+// GetGardenByPublicToken returns the garden whose public_token matches, or
+// domain.ErrNotFound. Possession of the token is the capability, so there is no
+// owner/actor check here — the service exposes this only for the unauthenticated
+// public-read path. public_token itself is never selected into the row (it stays
+// out of gardenColumns), so it can't leak through the returned garden.
+func (d *DB) GetGardenByPublicToken(ctx context.Context, token string) (*domain.Garden, error) {
+	g, err := scanGarden(d.sql.QueryRowContext(ctx,
+		`SELECT `+gardenColumns+` FROM gardens WHERE public_token = ?`, token))
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, domain.ErrNotFound
+	}
+	if err != nil {
+		return nil, fmt.Errorf("store: get garden by public token: %w", err)
+	}
+	return g, nil
+}
+
+// GetGardenPublicToken returns the garden's current public token (nil when the
+// public link is disabled), or domain.ErrNotFound if the garden is gone.
+func (d *DB) GetGardenPublicToken(ctx context.Context, gardenID int64) (*string, error) {
+	var tok sql.NullString
+	err := d.sql.QueryRowContext(ctx, `SELECT public_token FROM gardens WHERE id = ?`, gardenID).Scan(&tok)
+	if errors.Is(err, sql.ErrNoRows) {
+		return nil, domain.ErrNotFound
+	}
+	if err != nil {
+		return nil, fmt.Errorf("store: get garden public token: %w", err)
+	}
+	if !tok.Valid {
+		return nil, nil
+	}
+	return &tok.String, nil
+}
+
+// SetGardenPublicToken sets the garden's public token (enabling/rotating the
+// link) or clears it with a nil token (disabling the link). It does not bump the
+// garden version — the public link is out-of-band from garden edits, so toggling
+// it must not spuriously conflict a concurrent editor. Returns domain.ErrNotFound
+// if the garden is gone.
+func (d *DB) SetGardenPublicToken(ctx context.Context, gardenID int64, token *string) error {
+	var val any
+	if token != nil {
+		val = *token
+	}
+	res, err := d.sql.ExecContext(ctx,
+		`UPDATE gardens SET public_token = ?, updated_at = strftime('%Y-%m-%dT%H:%M:%SZ', 'now') WHERE id = ?`,
+		val, gardenID)
+	if err != nil {
+		return fmt.Errorf("store: set garden public token: %w", err)
+	}
+	n, err := res.RowsAffected()
+	if err != nil {
+		return fmt.Errorf("store: set garden public token rows: %w", err)
+	}
+	if n == 0 {
+		return domain.ErrNotFound
+	}
+	return nil
+}