fix: address Phase 4 code review (5 findings + symmetric snippet fix)

1. lib/snippets.ts + lib/memory-actions.ts (×2): shared-project key
   lookups were querying `projects` by key with no visibility scope. Since
   `projects.key` is unique per user (not global), the unscoped match
   could resolve another user's project entirely. Restricted the lookups
   to `readableProjectIds(userId, groupNames)` — own + shared only.

2. lib/access.ts getAccessibleProjects: a stray `if (existing) continue`
   inside the share-collapse loop short-circuited on the first match,
   killing the rw-beats-ro upgrade path. Two-group cases where one share
   was ro and another rw on the same project were incorrectly resolved
   as ro. Replaced with explicit owner/rw skip.

3. lib/mcp/tools.ts snippetPut: removed a dead `void exists` block that
   looked like an authorization pre-flight but was actually a no-op —
   real write authorization lives inside putSnippet, called next. Added
   a comment at the call site documenting where the check is.

4. memory.delete + snippet.delete: previously had no optimistic-lock
   CAS, so a concurrent peer edit could be silently overwritten by a
   delete on a stale view. Added optional `version` to MemoryDeleteInput
   (new) and SnippetDeleteInput (extended); UPDATE WHERE now CASes on
   version; 0-row response surfaces CONCURRENT_EDIT_ERROR. Web detail
   pages pass `version` through hidden form inputs. When the caller
   doesn't supply a version, falls back to the version we just read in
   the same handler for in-handler consistency.

5. lib/mcp/tools.ts memorySearch re-fetch: missing `isNull(deletedAt)`
   on the post-search row hydration left a TOCTOU window where a row
   soft-deleted between the search and the re-fetch would be returned.
   Visibility is still enforced by searchMemories itself.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/lib/snippets.ts

@@ -220,11 +220,20 @@ export async function putSnippet(
     if (owned) {
       projectId = owned;
     } else {
-      const sharedRow = await db
-        .select({ id: projects.id })
-        .from(projects)
-        .where(eq(projects.key, projectKey))
-        .limit(1);
+      // Restrict by-key lookup to projects the user can actually read —
+      // `projects.key` is unique per user, not globally, so an unscoped
+      // match could resolve another user's project entirely.
+      const readableIds = await readableProjectIds(userId, groupNames);
+      const sharedRow =
+        readableIds.length > 0
+          ? await db
+              .select({ id: projects.id })
+              .from(projects)
+              .where(
+                and(eq(projects.key, projectKey), inArray(projects.id, readableIds)),
+              )
+              .limit(1)
+          : [];
       if (sharedRow[0]) {
         const allowed = await canWriteProject(userId, groupNames, sharedRow[0].id);
         if (!allowed) {
@@ -386,9 +395,10 @@ export async function softDeleteSnippet(
     scope?: "project" | "user";
     projectKey?: string;
     groupNames?: string[];
+    version?: number;
   },
 ): Promise<{ id: string; scope: "project" | "user"; projectKey: string | null } | null> {
-  const { groupNames = [] } = args;
+  const { groupNames = [], version } = args;
   const target = await getSnippet(userId, args);
   if (!target) return null;
 
@@ -403,10 +413,19 @@ export async function softDeleteSnippet(
     if (!allowed) throw new Error("you don't have write access to this project");
   }
 
-  await db
+  // CAS on version so a peer's concurrent edit can't be silently dropped
+  // by this delete. Caller-supplied version wins; else we use the version
+  // we just read in `getSnippet` for in-handler consistency.
+  const expectedVersion = version ?? target.version;
+  const updated = await db
     .update(snippets)
     .set({ deletedAt: new Date(), lastEditedBy: userId })
-    .where(eq(snippets.id, target.id));
+    .where(and(eq(snippets.id, target.id), eq(snippets.version, expectedVersion)))
+    .returning({ id: snippets.id });
+
+  if (!updated[0]) {
+    throw new Error(CONCURRENT_EDIT_ERROR_SNIPPET);
+  }
 
   return {
     id: target.id,