Public read-only share link (#41)

A per-garden public link anyone can open read-only, with no login and no OIDC.

Backend:
- Migration 0004 adds gardens.public_token (nullable, unique over non-NULL).
- Owner-only management: GET/POST/DELETE /gardens/:id/share-link (state /
  enable-or-rotate / disable). The token is stored raw (it must be shown back
  to the owner) and never selected into the normal garden payload.
- Unauthenticated GET /api/v1/public/gardens/:token returns the read-only /full
  payload — the token is the capability, so no requireAuth and no redirect. The
  public view drops MyRole and OwnerID to minimize what an anonymous viewer
  learns. Unknown/rotated/disabled tokens are masked as 404.
- assembleFull is extracted from GardenFull so both reads return one shape.

Frontend:
- /g/$token route with NO auth guard (SPA fallback already serves it), rendering
  GardenCanvas read-only via usePublicGarden.
- Share dialog gains a Public link section: create, copy, regenerate, turn off.

Tests: service lifecycle + ACL (owner-only, non-owner masked, rotate/disable
invalidation) and the HTTP surface incl. the cookieless public read.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

web/src/lib/shares.ts

@@ -68,3 +68,49 @@ export function useRemoveShare(gardenId: number) {
     },
   })
 }
+
+// --- public share link (owner-only management) -----------------------------
+// The read-only public link that anyone (no account) can open. token is present
+// only when enabled; the page builds the URL as `${origin}/g/${token}`.
+
+export const shareLinkSchema = z.object({
+  enabled: z.boolean(),
+  token: z.string().optional(),
+})
+export type ShareLinkState = z.infer<typeof shareLinkSchema>
+
+const shareLinkKey = (gardenId: number) => ['share-link', gardenId] as const
+
+export function shareLinkQueryOptions(gardenId: number) {
+  return queryOptions({
+    queryKey: shareLinkKey(gardenId),
+    queryFn: async (): Promise<ShareLinkState> =>
+      shareLinkSchema.parse(await api.get(`/gardens/${gardenId}/share-link`)),
+  })
+}
+
+/** The garden's public-link state (owner-only endpoint). */
+export function useShareLink(gardenId: number) {
+  return useQuery(shareLinkQueryOptions(gardenId))
+}
+
+/** Enable the public link, or with { rotate: true } issue a fresh token that
+ *  invalidates the old URL. Writes the returned state straight into the cache. */
+export function useEnableShareLink(gardenId: number) {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: async ({ rotate = false }: { rotate?: boolean }): Promise<ShareLinkState> =>
+      shareLinkSchema.parse(await api.post(`/gardens/${gardenId}/share-link`, { rotate })),
+    onSuccess: (state) => qc.setQueryData(shareLinkKey(gardenId), state),
+  })
+}
+
+/** Disable the public link. */
+export function useDisableShareLink(gardenId: number) {
+  const qc = useQueryClient()
+  return useMutation({
+    mutationFn: async (): Promise<ShareLinkState> =>
+      shareLinkSchema.parse(await api.delete(`/gardens/${gardenId}/share-link`)),
+    onSuccess: (state) => qc.setQueryData(shareLinkKey(gardenId), state),
+  })
+}