Add sharing controls, invitation acceptance, and Shared with me

[brianorwhatever]

Parent: #255

Problem and outcome

The current Share modal describes public publication. Provide a private-sharing workflow with understandable role and lifecycle states across web and native apps.

Required behavior

• Owner controls: invite, view pending/accepted recipients, change role, revoke, resend, and inspect delivery failure. Default to viewer.
• Recipient controls: inspect inviter/own role, accept a pending invitation, open accepted resources in Shared with me, and leave without deleting the resource.
• Only owners see the complete recipient list. Recipients see the owner and their own role.
• Viewer/editor UI matches server permissions. Only owners rename, publish, or delete; deletion warns that everyone loses access.
• Explain that independent copies/exports survive revocation and cannot be recalled; copies do not inherit recipients or publication settings.
• Support web, iOS, Android, sign-in continuation, and web fallback for invitation links. Public status must remain obvious when named grants coexist with publication.

Acceptance and verification

• Exercise owner, viewer, editor, pending, expired, revoked, delivery-failed, and left-resource states.
• A newly accepted list or note appears automatically in Shared with me without public bookmarking.
• Recipient-list privacy holds in backend responses as well as UI.
• Leaving removes the grant and discovery entry without deleting owner data; reopening an old acceptance link does not restore access.
• Invitation links complete sign-in/acceptance on web and supported native clients, with working web fallback.
• Copies and destructive owner actions display the agreed consequences.

Starting points

src/components/ShareModal.tsx, list/note detail surfaces, and convex/lists.ts discovery queries.

Dependencies

Depends on #256, #257.

[pullfrog]

  ^{｜ Build this ➔ ｜ Make a plan ➔}

[brianorwhatever]

Starting implementation for coordinating thread 73c6a27c-b6d8-4f6a-9294-6ee92e8f3e46. Assignment: boop-258-73c6. Branch: feat/258-private-sharing-ui in isolated worktree /tmp/boop-issue-258-73c6. Scope: private sharing controls, invitation continuation, Shared with me, recipient privacy and lifecycle verification. Reusing merged grants/invitations/publication/revocation APIs; no live backend, production changes, merge, or deployment. Coordinator owns PR and independent review.

[brianorwhatever]

Implementation handoff for coordinating thread 73c6a27c-b6d8-4f6a-9294-6ee92e8f3e46, assignment boop-258-73c6.

Pushed feat/258-private-sharing-ui at a1c3e81. Sharing implementation is 438b1db; merged prerequisite #271 branch without cherry-picking in 2d6cea8. Coordinator owns PR creation and independent review; no PR, merge to main, deployment, or live data operations performed here.

Delivered shared owner controls embedded in ShareModal, note sharing/owner-only menu fixes, recipient-only Shared with me discovery with explicit privacy projection, confirmed leave/retry/removal, public-status distinction, revoked/left invitation status, deletion/copy consequences, native cold/warm invitation routing and association configuration. Existing invitation acceptance and permission APIs are reused. Details and boundaries: docs/private-sharing-ui.md.

Verification: full bun test retry 623 pass / 0 fail before the final added native/menu regressions and prerequisite merge; subsequent focused suites pass (19 new/sharing tests, then 16 post-merge invitation/menu/offline-monitor tests). App/backend/E2E typechecks pass after merge; focused lint and direct Vite build pass. Isolated desktop/mobile browser fixture exercised leave/removal with no page errors or horizontal overflow. T3 preview status/open were attempted, but the host explicitly reported unavailable, so a headless browser fallback was used.

Gaps: global ENOSPC prevents another full-suite run while coordinator checks run. Coordinator's shared E2E fixture needs the new sharing query responses (sent exact list to coordinator; respected its file ownership). Real OTP/mail, live subscriptions/transactions, signed native device builds and universal-link routing remain unverified. Android assetlinks still requires its release certificate fingerprint; HTTPS web fallback remains. No credentials/signing/actor/provenance internals changed.

[brianorwhatever]

PR opened: #272 at 28aa679, including the #271 baseline browser fix. Owner controls, Shared with me, confirmed leave, note permission controls, and native cold/warm link configuration are implemented. Independent review and latest-commit CI are underway; seven full-app sharing browser tests also pass after fixture integration. This does not claim live OTP/mail, installed native universal/App Link verification, or release fingerprint configuration; remaining limits are recorded in docs/private-sharing-ui.md.

[brianorwhatever]

Handoff: #272 is technically ready for maintainer review at 52e61e6. Latest CI is green: 631 unit tests, 116 browser tests, web/Android/unsigned iOS builds and Lighthouse. Independent delegated review and automated review are complete with all substantive findings fixed; GitHub reports no conflicts. #271 is included as a prerequisite and should merge first.

This does not close the release acceptance criteria: real OTP/mail, live Convex timing/concurrency, signed-device universal/App Link continuation, Android release fingerprint, and iOS App ID/match-profile Associated Domains compatibility still require the release environment. Those exact prerequisites are recorded in docs/private-sharing-ui.md. No further implementation is active for this assignment. Nothing was merged, no production credentials/data changed, and no manual deployment performed.