Owner-granted data shares: let named users at one user's per-user data

[thorwhalen]

Owner-granted data shares. Grants say who may open an app; a share says who may act on someone else's data in it: in app A, the owner's per-user store is readable (and by default writable) by a named grantee, signed in as themselves. First consumer: a public maths-practice app where a child's sessions are shared with her parents.

• ShareStore (auth/shares.py): (app, owner, grantee) records with access (rw/ro) and a grantee-facing label, beside grants under the platform store. A share names existing accounts only and is removed with either account (admin delete_user cascades).
• Owner routes /auth/shares/{app} (list, grant, revoke; a grantee can leave), admin /_admin/api/shares, CLI share / list-shares / revoke-share.
• Per-user store: ?owner= honoured through an active share (404 no_access otherwise; writes need rw), a list route GET /api/{app}/store?prefix= (walks only the owner's directory, sorted, capped), ETags and If-Match / If-None-Match: * conditional writes (412 with the current value), refusal of values that cannot round-trip (NaN, lone surrogates), and CSRF on writes via CSRFMiddleware(enforce_prefixes=...) although /api/ is otherwise exempt.
• user_store = true in an app.toml (enlace >= 0.1.43) gives a public app a per-user store for its signed-in visitors.

Upgrading: store writes now need X-CSRF-Token; /api/{app}/store is reserved. No known deployment used either.

Design, its adversarial review, and a second adversarial review of this code (findings fixed in the second and third commits): misc/docs/decisions/0001-owner-granted-data-shares.md.

Tests: tests/test_shares.py (store, routes, router, an end-to-end public user_store app, CSRF, admin cascade, review fixes); full suite 437 passed.