feat: share heaps and folders with other users, fix auth and vision pipeline

Sharing:
- New HeapShare and FolderShare models with read/write permissions
- Sharing API router (CRUD for heap and folder shares)
- Heap endpoints accept shared access (photo_ids, add/remove with write)
- Photo list drops user_id filter in shared context, adds owner_username
- Media serving (thumb/original/proxy) falls back to share check on 404
- ShareDialog component for managing shares from kebab menus
- HeapsPanel shows "Shared with me" section for shared heaps
- LeftSidebar shows "Shared with me" section for shared folders
- Owner badge on PhotoThumbnail for photos from other users

Auth:
- Access token default bumped to 1 year, refresh to 10 years
- Refresh token persisted in localStorage (survives page reload)
- Timer-based refresh replaced with 401 axios interceptor

Vision pipeline fixes:
- Bootstrap sets Redis ready key even on partial export failure
- Export functions run conditionally (only for actually missing models)
- _load_thumb handles multi-user path (/data/thumbs/{user_id}/{photo_id}/)
- can_access_photo_via_share uses single subquery instead of N+1 loop

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/routers/heaps.py

@@ -15,7 +15,7 @@ from app.models import Heap, Photo, Folder
 from app.models.folders import SourceRoot
 from app.models.heaps import heap_photos
 from app.models.user import User
-from app.dependencies import get_current_user, get_user_heap
+from app.dependencies import get_current_user, get_user_heap, get_user_or_shared_heap
 
 logger = logging.getLogger(__name__)
 
@@ -216,7 +216,7 @@ async def get_heap_photo_ids(
     to maintain a fast client-side membership lookup for the active heap
     (for the basket affordance on thumbnails) without fetching full photo
     records."""
-    await get_user_heap(heap_id, current_user, db)
+    await get_user_or_shared_heap(heap_id, current_user, db)
     result = await db.execute(
         select(heap_photos.c.photo_id).where(heap_photos.c.heap_id == heap_id)
     )
@@ -231,8 +231,11 @@ async def add_photos_to_heap(
     current_user: User = Depends(get_current_user),
 ):
     """Add photos to a heap. Idempotent: re-adding existing members is a
-    no-op (handled by an INSERT OR IGNORE-style filter on duplicates)."""
-    await get_user_heap(heap_id, current_user, db)
+    no-op (handled by an INSERT OR IGNORE-style filter on duplicates).
+    Shared users with write permission can add their own photos."""
+    _heap, permission = await get_user_or_shared_heap(heap_id, current_user, db)
+    if permission == "read":
+        raise HTTPException(status_code=403, detail="Read-only access to this heap")
 
     if not body.photo_ids:
         return {"status": "success", "added": 0}
@@ -426,8 +429,11 @@ async def remove_photos_from_heap(
     db: AsyncSession = Depends(get_db),
     current_user: User = Depends(get_current_user),
 ):
-    """Remove photos from a heap. Removing a non-member is a no-op."""
-    await get_user_heap(heap_id, current_user, db)
+    """Remove photos from a heap. Removing a non-member is a no-op.
+    Shared users with write permission can remove photos."""
+    _heap, permission = await get_user_or_shared_heap(heap_id, current_user, db)
+    if permission == "read":
+        raise HTTPException(status_code=403, detail="Read-only access to this heap")
 
     if not body.photo_ids:
         return {"status": "success", "removed": 0}