feat(sharing): project shares, co-edit safety, awareness UI (Phase 4c+d+e)

Adds project-level sharing via the new project_shares table plus the
infrastructure that makes multi-user editing safe and visible.

Authorization (lib/access.ts):
  - getAccessibleProjects / getProjectAccess centralise the predicate
    used by every read and write path.
  - readableProjectIds / writableProjectIds drive listing-style queries.
  - Web UI Server Actions and pages source group memberships from the
    user_groups table so authorization works without depending on
    Agent A's session callback shape.

Optimistic locking:
  - memories + snippets gain version + last_edited_by columns. Every
    UPDATE bumps version and stamps the editor; UPDATE WHERE clauses
    require the caller's pre-fetched version, surfacing a clear
    "refresh and try again" error on lost-write races rather than
    silently clobbering.
  - MemoryUpdateInput / SnippetPutInput accept an optional version
    token.

MCP tools:
  - memory.write / .update / .delete / .get / .list / .search,
    snippet.put / .get / .list / .delete now respect shared-project
    access (read = owner | any share, write = owner | rw share).
  - project, defaults to ctx.defaultProjectKey from the X-Project-Key
    header (populated by the MCP route — Agent A's wiring).
  - project.identify returns shared projects you have access to and
    prefers an owned project on key collision, audit-logging the
    collision so an operator can debug it.
  - Tool descriptions for memory.update, memory.write, snippet.put,
    and project.identify updated with the co-edit / shared-project
    notes.

Web UI:
  - Project detail page: ownership badge, shared-with-N-groups badge,
    owner-only "Manage sharing" section (add/flip/remove shares via
    lib/share-actions.ts). Add-share is constrained to groups the
    granter is already in.
  - "Shared" chips on memory cards in /memories and /dashboard.
  - "Last edited by ..." on memory + snippet detail pages, shown only
    when the last editor isn't the row's original author so the chip
    stays informative.
  - Read-only viewers (ro shares) lose Edit/Delete affordances on
    memories and snippets.

Migration 0004_project_shares.sql adds project_shares + the two new
columns on memories and snippets; it depends on Agent A's
0003_groups.sql for the groups, user_groups, and memory_access enum.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/app/(authed)/dashboard/page.tsx

@@ -1,8 +1,9 @@
 import Link from "next/link";
-import { and, desc, eq, isNull, sql, count } from "drizzle-orm";
+import { and, desc, eq, inArray, isNull, or, sql, count } from "drizzle-orm";
 import { auth } from "@/auth";
 import { db } from "@/lib/db/client";
-import { memories, projects } from "@/lib/db/schema";
+import { memories, projects, projectShares } from "@/lib/db/schema";
+import { getUserGroupNames, readableProjectIds } from "@/lib/access";
 import { Container, PageHeader } from "@/app/_components/ui/container";
 import { Card, CardBody, CardHeader } from "@/app/_components/ui/card";
 import { Badge } from "@/app/_components/ui/badge";
@@ -14,14 +15,27 @@ export const dynamic = "force-dynamic";
 export default async function DashboardPage() {
   const session = await auth();
   const userId = session!.user.id;
+  const groupNames = await getUserGroupNames(userId);
 
+  // Visibility widening — recent + counts include memories under
+  // projects shared with the user's groups.
+  const accessibleIds = await readableProjectIds(userId, groupNames);
+  const visibility =
+    accessibleIds.length > 0
+      ? or(eq(memories.userId, userId), inArray(memories.projectId, accessibleIds))
+      : eq(memories.userId, userId);
+
+  // Dashboard's "Projects" card stays owned-only — the list of projects
+  // you actively own. Shared projects show up via the memory list and
+  // the per-project page; surfacing them here would make the panel
+  // confusing about who owns what.
   const [counts, recent, topProjects] = await Promise.all([
     db
       .select({
         total: count(memories.id),
       })
       .from(memories)
-      .where(and(eq(memories.userId, userId), isNull(memories.deletedAt))),
+      .where(and(visibility!, isNull(memories.deletedAt))),
     db
       .select({
         id: memories.id,
@@ -29,11 +43,12 @@ export default async function DashboardPage() {
         scope: memories.scope,
         tags: memories.tags,
         createdAt: memories.createdAt,
+        projectId: memories.projectId,
         projectKey: projects.key,
       })
       .from(memories)
       .leftJoin(projects, eq(memories.projectId, projects.id))
-      .where(and(eq(memories.userId, userId), isNull(memories.deletedAt)))
+      .where(and(visibility!, isNull(memories.deletedAt)))
       .orderBy(desc(memories.createdAt))
       .limit(5),
     db
@@ -54,6 +69,22 @@ export default async function DashboardPage() {
       .limit(4),
   ]);
 
+  // Annotate "Shared" chips on the recent panel.
+  const projectIds = recent
+    .map((r) => r.projectId)
+    .filter((p): p is string => p !== null);
+  const sharedProjects =
+    projectIds.length > 0
+      ? new Set(
+          (
+            await db
+              .selectDistinct({ projectId: projectShares.projectId })
+              .from(projectShares)
+              .where(inArray(projectShares.projectId, projectIds))
+          ).map((r) => r.projectId),
+        )
+      : new Set<string>();
+
   const memoryTotal = counts[0]?.total ?? 0;
 
   return (
@@ -94,6 +125,11 @@ export default async function DashboardPage() {
                       <Badge tone={m.scope === "user" ? "accent" : "neutral"}>
                         {m.scope}
                       </Badge>
+                      {m.projectId && sharedProjects.has(m.projectId) ? (
+                        <Badge tone="accent" title="Shared with one or more groups">
+                          Shared
+                        </Badge>
+                      ) : null}
                       {m.projectKey ? <span>· {m.projectKey}</span> : null}
                       <span className="ml-auto">
                         {new Date(m.createdAt).toLocaleDateString()}