Add hosted multi-user collection sharing

[callumalpass]

Summary

• add stable logical collection identities, immutable role-policy revisions, membership-bound grants/replicas, and transaction-time authorization revalidation
• add privacy-safe hosted invitations, one-use invitee sharing codes, owner-funded seat accounting, role changes, and durable provider-backed downgrade/revocation
• add management-client APIs and polished Editor sharing/acceptance UI with permission-aware owner controls
• preserve applied migration checksums, delete sharing state transactionally with hosted collections, and cover account/invitation lifecycle cascades

Security and lifecycle contract

• unresolved email invitations remain deliberately unclaimable and do not reveal account existence
• role presets materialize exact immutable action/operation/scope/file ceilings
• downgrade/revoke invalidates derived grants, access/refresh tokens, replicas, pairing requests, and pending authorizations before provider cleanup
• seats are consumed transactionally on acceptance and released only after durable revocation completes
• editors may manage viewer/editor memberships and rename collections; authority transfer, permanent deletion, billing, and seats remain owner-only

Validation

• pnpm test:fast
• pnpm --filter @mdbase/connect-management test
• pnpm --filter mdbase-editor test (43 files / 290 tests)
• pnpm --filter mdbase-editor typecheck
• pnpm e2e:provider against disposable PostgreSQL 18 and S3-compatible storage
• disposable PostgreSQL 18 invitation final-seat race (one success, one typed collection_member_seat_unavailable)
• workspace typecheck, architecture checks, operation checks, and targeted server suites
• independent adversarial audits of schema, authorization, lifecycle, privacy, Editor UX, and final fixes

Rollout

Hosted sharing implementation is complete, but production enablement remains gated on replication/availability hardening and multi-account Editor/TaskNotes acceptance against a deployed PR build. Local-authority sharing is intentionally deferred until the hosted lifecycle is proven operationally.