add agent-mode diagram sharing

[fabracht]

Summary

• share diagrams with named users at view/edit via $DB/{e}/{id}/share|unshare|shares and $DB/{e}/shared; owner/admin-only, set-to-level upsert, revoke, "shared with me" discovery
• share-aware access: read needs view, update needs edit, delete stays owner-only; _shares is server-managed (generic CRUD on it returns 403)
• transitive cascade over diagram→diagram references (bounded, cycle-safe); grantee email→canonical-id resolution in OAuth mode (resolve-existing)
• agent mode only — cluster parity tracked in cluster parity for diagram sharing #75; pending grants deferred

Test plan

• share gating: view reads but can't update; edit updates but can't delete; owner deletes
• endpoints: owner-only share/list, set-to-level replace, discovery, non-owner 403, _shares CRUD blocked
• cascade A→B→C share + revoke across the closure
• indexed grant path correct and idempotent
• grantee email→canonical-id resolution (unit)