feat(sharing): project shares, co-edit safety, awareness UI (Phase 4c+d+e)

Adds project-level sharing via the new project_shares table plus the
infrastructure that makes multi-user editing safe and visible.

Authorization (lib/access.ts):
  - getAccessibleProjects / getProjectAccess centralise the predicate
    used by every read and write path.
  - readableProjectIds / writableProjectIds drive listing-style queries.
  - Web UI Server Actions and pages source group memberships from the
    user_groups table so authorization works without depending on
    Agent A's session callback shape.

Optimistic locking:
  - memories + snippets gain version + last_edited_by columns. Every
    UPDATE bumps version and stamps the editor; UPDATE WHERE clauses
    require the caller's pre-fetched version, surfacing a clear
    "refresh and try again" error on lost-write races rather than
    silently clobbering.
  - MemoryUpdateInput / SnippetPutInput accept an optional version
    token.

MCP tools:
  - memory.write / .update / .delete / .get / .list / .search,
    snippet.put / .get / .list / .delete now respect shared-project
    access (read = owner | any share, write = owner | rw share).
  - project, defaults to ctx.defaultProjectKey from the X-Project-Key
    header (populated by the MCP route — Agent A's wiring).
  - project.identify returns shared projects you have access to and
    prefers an owned project on key collision, audit-logging the
    collision so an operator can debug it.
  - Tool descriptions for memory.update, memory.write, snippet.put,
    and project.identify updated with the co-edit / shared-project
    notes.

Web UI:
  - Project detail page: ownership badge, shared-with-N-groups badge,
    owner-only "Manage sharing" section (add/flip/remove shares via
    lib/share-actions.ts). Add-share is constrained to groups the
    granter is already in.
  - "Shared" chips on memory cards in /memories and /dashboard.
  - "Last edited by ..." on memory + snippet detail pages, shown only
    when the last editor isn't the row's original author so the chip
    stays informative.
  - Read-only viewers (ro shares) lose Edit/Delete affordances on
    memories and snippets.

Migration 0004_project_shares.sql adds project_shares + the two new
columns on memories and snippets; it depends on Agent A's
0003_groups.sql for the groups, user_groups, and memory_access enum.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

apps/web/lib/snippet-actions.ts

@@ -10,6 +10,7 @@ import {
   SnippetDeleteInput,
 } from "@shared-memory/schemas";
 import { putSnippet, softDeleteSnippet } from "@/lib/snippets";
+import { getUserGroupNames } from "@/lib/access";
 
 /**
  * Server Actions for snippet CRUD from the Web UI. Mirrors the MCP
@@ -17,6 +18,10 @@ import { putSnippet, softDeleteSnippet } from "@/lib/snippets";
  * indistinguishable on the storage layer.
  *
  * `actor` is "web" in audit_log so we can tell the two paths apart later.
+ *
+ * Sharing: project-scope snippets under a shared project can be edited
+ * by any user with rw access via this path; the `putSnippet` helper
+ * enforces authorization and optimistic-locking concurrency control.
  */
 
 async function requireUserId(): Promise<string> {
@@ -41,6 +46,7 @@ function targetUrl(scope: "project" | "user", name: string, projectKey: string |
 
 export async function createSnippetAction(formData: FormData) {
   const userId = await requireUserId();
+  const groupNames = await getUserGroupNames(userId);
 
   const scope = (formData.get("scope") as "project" | "user") || "user";
   const projectRaw = (formData.get("project") as string | null)?.trim();
@@ -65,6 +71,7 @@ export async function createSnippetAction(formData: FormData) {
     tags: parsed.data.tags,
     scope: parsed.data.scope,
     projectKey: parsed.data.project,
+    groupNames,
   });
 
   await db.insert(auditLog).values({
@@ -87,11 +94,17 @@ export async function createSnippetAction(formData: FormData) {
 
 export async function updateSnippetAction(formData: FormData) {
   const userId = await requireUserId();
+  const groupNames = await getUserGroupNames(userId);
 
   // Edits keep the row's identity (scope + name + project unchanged) —
   // body/description/tags are what changes. Treat as a put on the same key.
   const scope = (formData.get("scope") as "project" | "user") || "user";
   const projectRaw = (formData.get("project") as string | null)?.trim();
+  const rawVersion = formData.get("version");
+  const versionNum =
+    typeof rawVersion === "string" && rawVersion.length > 0
+      ? Number.parseInt(rawVersion, 10)
+      : undefined;
   const payload = {
     name: String(formData.get("name") ?? "").trim(),
     body: String(formData.get("body") ?? ""),
@@ -99,6 +112,7 @@ export async function updateSnippetAction(formData: FormData) {
     tags: parseTags(formData.get("tags")),
     scope,
     project: scope === "project" ? projectRaw || undefined : undefined,
+    version: Number.isFinite(versionNum) ? versionNum : undefined,
   };
 
   const parsed = SnippetPutInput.safeParse(payload);
@@ -113,6 +127,8 @@ export async function updateSnippetAction(formData: FormData) {
     tags: parsed.data.tags,
     scope: parsed.data.scope,
     projectKey: parsed.data.project,
+    groupNames,
+    version: parsed.data.version,
   });
 
   await db.insert(auditLog).values({
@@ -135,6 +151,7 @@ export async function updateSnippetAction(formData: FormData) {
 
 export async function deleteSnippetAction(formData: FormData) {
   const userId = await requireUserId();
+  const groupNames = await getUserGroupNames(userId);
 
   const scope = formData.get("scope") as "project" | "user" | null;
   const projectRaw = (formData.get("project") as string | null)?.trim();
@@ -153,6 +170,7 @@ export async function deleteSnippetAction(formData: FormData) {
     name: parsed.data.name,
     scope: parsed.data.scope,
     projectKey: parsed.data.project,
+    groupNames,
   });
   if (!deleted) throw new Error("not found");