feat(notes): share a note with a person, not only through a project

Until now a note was shared exactly one way: file it in a shared project, and
everyone who could read the project could read the note. That is right when the
note belongs with a body of work and wrong when it is just "let Sofie see this" —
it made you stand up a project to hand over a single page.

A note can now be shared with named people directly, at viewer or editor — the
same two roles a project membership uses, so there is one idea of a role in the
program and not two. The paths stack: a note can be loose, filed, shared with
people, or any mix, and access is the most any of them allow.

The store:
  - note_shares (migration 0030): note ↔ user ↔ role, one row per person, owner
    recorded. Visibility (AllNotes, and search via mayTouchNote) widens to include
    notes shared directly with the reader.
  - the effective role folds a direct share on top of the owner and project paths.

The rules, drawn where they protect the owner:
  - read = viewer, edit text = editor, on any path.
  - MOVE a note (change its project) is owner-only: an editor filing it into a
    project the owner is not in would take the owner's own note away from them.
  - DELETE is owner or project-editor — a direct share, however high its role,
    does not reach to throwing the note away.
  - SHARE and UNSHARE are the owner's alone, like a project's invitations.
  - the picker is everyone on the instance (a closed, invited set) minus who is
    already on the note; a made-up id and the owner themselves are refused.

The list:
  - a "Delt med mig" group at the top, collapsible, that appears only when it has
    something in it — the same rule Favoritter follows — so it costs nothing when
    you share nothing. A shared note lives there, not also in a time bucket.
  - every shared note carries a small chip in its owner's avatar colour, the
    project mark's shape said for a person.
  - no star or archive button on a note somebody else owns: those change the note
    itself, and it is not yours to put away.
  - the editor grows a "Del med personer" panel for the owner: who can see it, at
    what role, and an add row drawn from the instance's other people.

The old comment in the notes footer argued against a note having an access list
of its own. That was the right call until the case it did not cover — sharing
without a project — turned out to be the one actually asked for. Updated to match.

Person now carries json tags, so a note's owner serialises as id/name/avatar_color
like every other person in the API rather than as Go field names.

Tests: a shared note reaches the other person marked and owned; a viewer reads but
cannot write; an editor writes but cannot re-share or delete; unshare removes
access and is owner-only; the candidate list excludes who is already on and the
owner; and a made-up id and self are refused. OpenAPI covers the three new routes.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

docs/openapi.yaml

@@ -3072,6 +3072,69 @@ paths:
         "204": { description: Deleted }
         "404": { $ref: "#/components/responses/NotFound" }
 
+  /api/v1/notes/{noteID}/shares:
+    parameters:
+      - name: noteID
+        in: path
+        required: true
+        schema: { type: string }
+    get:
+      tags: [notes]
+      summary: Who a note is shared with, and who it can be shared with.
+      description: >
+        Owner only. Returns the people the note is already shared with, each with
+        their role, and the candidates the owner may add — everyone on the instance
+        who is not already on the note.
+      responses:
+        "200":
+          description: OK
+          content:
+            application/json:
+              schema:
+                type: object
+                properties:
+                  shares:
+                    type: array
+                    items: { $ref: "#/components/schemas/NoteShare" }
+                  candidates:
+                    type: array
+                    items: { $ref: "#/components/schemas/Person" }
+        "404": { $ref: "#/components/responses/NotFound" }
+    post:
+      tags: [notes]
+      summary: Share a note with a person, or change the role they hold.
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [user_id]
+              properties:
+                user_id: { type: string }
+                role: { type: string, enum: [viewer, editor] }
+      responses:
+        "204": { description: Shared }
+        "404": { $ref: "#/components/responses/NotFound" }
+        "422": { $ref: "#/components/responses/Validation" }
+
+  /api/v1/notes/{noteID}/shares/{userID}:
+    delete:
+      tags: [notes]
+      summary: Take a person's access to a note away again.
+      parameters:
+        - name: noteID
+          in: path
+          required: true
+          schema: { type: string }
+        - name: userID
+          in: path
+          required: true
+          schema: { type: string }
+      responses:
+        "204": { description: Unshared }
+        "404": { $ref: "#/components/responses/NotFound" }
+
   /api/v1/notes/linking/{kind}/{targetID}:
     get:
       tags: [notes]
@@ -3907,6 +3970,14 @@ components:
         pinned: { type: boolean }
         created_at: { type: string, format: date-time }
         updated_at: { type: string, format: date-time }
+        shared_with_me:
+          type: boolean
+          description: >
+            True when the reader reached this note through a direct share rather
+            than by owning it or its project. What puts it in the Delt med mig group.
+        owner:
+          allOf: [{ $ref: "#/components/schemas/Person" }]
+          description: Who the note belongs to, present on a note shared with the reader.
         links:
           type: array
           description: What the body points at, read out of the text on the way in.
@@ -3923,6 +3994,21 @@ components:
         body: { type: string, description: "Markdown. Its first line becomes the title." }
         pinned: { type: boolean }
 
+    Person:
+      type: object
+      description: A user, as much of one as a name and a colour.
+      properties:
+        id: { type: string }
+        name: { type: string }
+        avatar_color: { type: string }
+
+    NoteShare:
+      type: object
+      description: One person's direct grant on a note.
+      properties:
+        user: { $ref: "#/components/schemas/Person" }
+        role: { type: string, enum: [viewer, editor] }
+
     Mailbox:
       type: object
       description: One connected mailbox. The password and any token are never returned.