Add Entity Sharing

Add entity sharing support

Mirror the todo / vacation pattern. Prefer vacations as the simpler leaf reference; todos for life-plan association quirks.

Canonical references:

• Backend: src/core/jupiter/core/apps/vacations/sub/vacation/service/load.py, sub/vacation/use_case/find.py, sub/vacation/use_case/load.py
• Leaf UI: src/webui/app/routes/app/workspace/apps/vacations/vacation/$id.tsx
• Trunk UI: src/webui/app/routes/app/workspace/apps/vacations.tsx
• Todo extras: src/core/jupiter/core/apps/todo/components/properties-editor.tsx
• Tests: itests/api/vacations.test.py, itests/webui/entities/vacations.test.py
• Access infra: src/core/jupiter/core/common/sub/access/

Checklist

Copy and track:

Sharing Progress:
- [ ] 1. Allowlist + crown ACL bases
- [ ] 2. Load result: owner + access_status
- [ ] 3. Find result: owner + access_status + cross-workspace
- [ ] 4. Mutation use cases (writer for non-owners)
- [ ] 5. Generate clients
- [ ] 6. Leaf panel access wiring
- [ ] 7. Trunk owner chip
- [ ] 8. Entity-specific foreign refs (if any)
- [ ] 9. API + WebUI ACL tests

1. Allowlist + crown ACL

• Entity type must be in ALLOWED_SHARED_ACCESS_OWNER_TYPES in src/core/jupiter/core/common/sub/access/shareable.py.
• If the entity needs extra access refresh beyond OwnsLink/ContainsLink cascade, add a RefreshAccessForEntityService and register it in REFRESH_ACCESS_FOR_ENTITY_SERVICES in that same file.
• Create must grant OWNER (via JupiterCreateCrownEntityUseCase / create_entity).
• Load/find/update/archive/remove should already use Jupiter*CrownEntityUseCase bases (READER for load/find, WRITER for mutations). If not, migrate them.

2. Load: return owner + access_status

In the entity load service result:

owner: UserLight
access_status: AccessStatus | None  # None for public/guest load

Resolve with:

• LoadUserThatOwnsEntityService().do_it(uow, entity_link)
• GetAccessLevelForEntityService().do_it(...) only when user_ref_id is set

Pass user_ref_id=context.user.ref_id from the authenticated load use case. Public load must omit user_ref_id so access_status stays None.

3. Find: owner + access_status + cross-workspace

In each find result entry:

owner: UserLight
access_status: AccessStatus  # non-optional

Required pattern (do not constrain to the caller's collection parent):

entities = await self.find_all_entities(
    uow, context.user.ref_id, Entity, allow_archived=..., filter_ref_ids=...
)

Then bulk-resolve:

• OwnerUserRefIdsForEntitiesService + UserRepository.find_all_light_by_ref_ids
• AccessStatusRepository.load_all_for_entities_and_user

Use @use_case_result_part for the entry type when matching todos/vacations.

4. Mutation use cases for non-owners

Shared writers must be able to update/archive/remove without owning linked crown entities they are not retargeting.

• Prefer crown bases: load_entity / check_entity → WRITER on the entity.
• If update validates related crown entities (aspects, chapters, …), only ACL-check them when the ref id actually changes. Keeping the owner's existing links must succeed for shared writers.
• Tag/contact upsert and publish typically require OWNER — leave as-is; disable those UI controls via accessStatus when not owner.

5. Generate clients

After changing use-case IO:

mise run generate-client-code

Wait for Client code generation complete on stderr.

6. Leaf panel access wiring

In $id.tsx (or equivalent leaf):

1. Loader returns owner and accessStatus from load result.
2. Gate editing:

const inputsEnabled =
  navigation.state === "idle" &&
  !entity.archived &&
  accessStatusAllowsWriterOrAbove(loaderData.accessStatus);

3. Pass to LeafPanel (note spelling accessable):

accessable
accessOwner={loaderData.owner}
accessStatus={loaderData.accessStatus}

4. Pass accessStatus through to publish so non-owners cannot publish.
5. returnLocation on the panel is used by Forget → redirect to trunk.

Forget flow (shared infra — do not break it):

• forget-grant action redirects to returnLocation after remove.
• Do not skip revalidation for forget-grant: trunk must reload so the entity disappears from the list; redirect avoids reloading the leaf.