Add hosted collection sharing with v2 grant ceilings

[callumalpass]

Hosted collection owners can invite verified accounts as viewers or editors, with each application and mirror constrained by the member’s exact policy revision. This refresh merges current main (b34ba70f, beta.97) into the original sharing branch and repairs the authorization and account-cleanup integration.

• Materialize new viewer/editor presets from canonical v2 capability groups. Required writes fail for viewers; consent shows only complete capability groups and file actions permitted by the current membership. Applications requiring unavailable permissions cannot be selected for that collection. New editors cannot manage memberships. Existing immutable snapshots retain their exact authority until explicitly changed.
• Enforce operation, file and whole-collection ceilings across application approval/token issuance, direct mirrors, browser/desktop pairing and renewal. Bind every member grant/replica to its membership revision; serialize issuance and collection rename with removal.
• Allow removal to supersede a pending downgrade, invalidate pending delegations, and retain occupied seats until provider cleanup completes, including after account deletion. Reuse the existing cleanup worker.
• Preserve the four original sharing migration filenames and checksums. Add a forward migration for detached cleanup seat reservations; set invited/open beta seats explicitly to ten and new profile defaults to zero.
• Add the independent, default-off MDBASE_CONNECT_HOSTED_SHARING_ENABLED admission switch. Disabling it preserves existing access and allows listing, cancellation, downgrade and removal. Block hosted-to-local transfer while members or invitations remain.
• Make Editor writes and schema management optional, render viewer controls read-only, support member mirror pairing, and refresh pending sharing transitions. Email invitations require an already registered verified recipient; the UI explains when a new invitation is needed.

Validation on Node 24.19.0, with mdbase-rs pinned to 76ceed00:

• cargo fmt --all -- --check, cargo test --workspace, pnpm typecheck, pnpm test, pnpm e2e passed. The final server rerun passed 575 tests; Editor passed 452.
• All 52 Editor Playwright tests passed locally after correcting the browser manifest fixture; the production Editor build, bundle budget and CSP checks also passed. PR CI is rerunning on the role-aware consent follow-up.
• Architecture and generated capability checks passed. Six server modules represent policy, binding, invitations, cleanup, routing and shared mirror checks; their package/import/export budgets are reviewed, including one shared grant-planner preview export; existing file-size limits are unchanged.
• The registered provider and files system suites passed against disposable PostgreSQL 18 and S3-compatible storage.
• Seven additional PostgreSQL tests passed: cross-collection final-seat contention, mirror issuance/removal, rename/removal, provider outage with account deletion, and owner/member deletion with bound application grants.
• Fresh install, beta.97 upgrade and original-Add hosted collection sharing with v2 grant ceilings #317 upgrade each reached the same 37 control-plane migrations. Repeat application verified checksums and collection identity.

Sharing remains off by default. The LAB candidate passed deployment checks. Multi-account acceptance verified invitation UI and viewer API/mirror boundaries, then exposed the optional-write consent defect fixed here; full Editor/TaskNotes acceptance is being repeated. Production enablement still requires that acceptance and exact release/catalog qualification. Invitation preview is a follow-up. Local-authority sharing and PR #318’s realtime collaboration are outside this PR.

Multi-account LAB acceptance now passes for owner/viewer/editor invitation flows,
real Editor and TaskNotes v2 approvals, persisted task recovery, downgrade/removal
revocation, and account deletion with bound mirror cleanup. All campaign fixtures
and the temporary account were removed. This is disposable LAB evidence, separate
from signed release qualification.

Includes beta98 version preparation and exact beta97 predecessor image pins so
full merge qualification exercises the actual upcoming upgrade. Historical beta95
regression pins remain unchanged. Production recovery policy is handled in ops;
this PR does not claim beta98-to-beta97 image rollback safety.