A per-garden public link anyone can open read-only, with no login and no OIDC.

Backend:
- Migration 0004 adds gardens.public_token (nullable, unique over non-NULL).
- Owner-only management: GET/POST/DELETE /gardens/:id/share-link (state /
  enable-or-rotate / disable). The token is stored raw (it must be shown back
  to the owner) and never selected into the normal garden payload.
- Unauthenticated GET /api/v1/public/gardens/:token returns the read-only /full
  payload — the token is the capability, so no requireAuth and no redirect. The
  public view drops MyRole and OwnerID to minimize what an anonymous viewer
  learns. Unknown/rotated/disabled tokens are masked as 404.
- assembleFull is extracted from GardenFull so both reads return one shape.

Frontend:
- /g/$token route with NO auth guard (SPA fallback already serves it), rendering
  GardenCanvas read-only via usePublicGarden.
- Share dialog gains a Public link section: create, copy, regenerate, turn off.

Tests: service lifecycle + ACL (owner-only, non-owner masked, rotate/disable
invalidation) and the HTTP surface incl. the cookieless public read.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>
Claude-Session: https://claude.ai/code/session_01JdQpdYYsTgtkJBxbcpAszi

@@ -0,0 +10,4 @@
+// public share token. It sits OUTSIDE requireAuth — the token itself is the
+// capability — so a logged-out visitor can open a shared link without ever being
+// bounced to /login or the OIDC flow. An unknown or disabled token is a 404.
+func (h *handlers) getPublicGarden(c *gin.Context) {

@@ -0,0 +16,4 @@
+		writeServiceError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, full)

@@ -0,0 +45,4 @@
+	var req struct {
+		Rotate bool `json:"rotate"`
+	}
+	_ = c.ShouldBindJSON(&req)

@@ -0,0 +64,4 @@
+		writeServiceError(c, err)
+		return
+	}
+	c.JSON(http.StatusOK, gin.H{"enabled": false})

@@ -0,0 +33,4 @@
+	g, err := s.store.GetGardenByPublicToken(ctx, token)
+	if err != nil {
+		return nil, err
+	}

@@ -0,0 +40,4 @@
+	}
+	// Minimize what an anonymous viewer learns: no role, and don't expose the
+	// owner's user id (the page renders fine without it).
+	full.Garden.MyRole = ""

@@ -133,0 +154,4 @@
+  const url = token ? `${window.location.origin}/g/${token}` : ''
+  const busy = link.isPending || enable.isPending || disable.isPending
+
+  const run = (p: Promise<unknown>, fallback: string) => {

@@ -133,0 +164,4 @@
+    try {
+      await navigator.clipboard.writeText(url)
+      setCopied(true)
+      window.setTimeout(() => setCopied(false), 1500)

@@ -71,0 +75,4 @@
+
+export const shareLinkSchema = z.object({
+  enabled: z.boolean(),
+  token: z.string().optional(),

@@ -0,0 +24,4 @@
+
+  // Start from a clean canvas: if a logged-in user reaches here from their own
+  // editor, stale focus/selection state would otherwise dim or highlight things.
+  useEffect(() => {

@@ -0,0 +35,4 @@
+    s.setLivePlanting(null)
+  }, [token])
+
+  const objects = useMemo(() => full.data?.objects.map(toEditorObject) ?? [], [full.data?.objects])