feat: share heaps and folders with other users, fix auth and vision pipeline

Sharing:
- New HeapShare and FolderShare models with read/write permissions
- Sharing API router (CRUD for heap and folder shares)
- Heap endpoints accept shared access (photo_ids, add/remove with write)
- Photo list drops user_id filter in shared context, adds owner_username
- Media serving (thumb/original/proxy) falls back to share check on 404
- ShareDialog component for managing shares from kebab menus
- HeapsPanel shows "Shared with me" section for shared heaps
- LeftSidebar shows "Shared with me" section for shared folders
- Owner badge on PhotoThumbnail for photos from other users

Auth:
- Access token default bumped to 1 year, refresh to 10 years
- Refresh token persisted in localStorage (survives page reload)
- Timer-based refresh replaced with 401 axios interceptor

Vision pipeline fixes:
- Bootstrap sets Redis ready key even on partial export failure
- Export functions run conditionally (only for actually missing models)
- _load_thumb handles multi-user path (/data/thumbs/{user_id}/{photo_id}/)
- can_access_photo_via_share uses single subquery instead of N+1 loop

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/tasks/vision.py

@@ -53,11 +53,22 @@ def _get_sync_session() -> Session:
 
 
 def _load_thumb(photo_id: str, size: str = "medium") -> np.ndarray | None:
-    """Load a thumbnail as an RGB numpy array."""
-    thumb_path = Path(f"/data/thumbs/{photo_id}/{size}.webp")
+    """Load a thumbnail as an RGB numpy array.
+
+    Thumbnails may live at ``/data/thumbs/{photo_id}/`` (legacy) or
+    ``/data/thumbs/{user_id}/{photo_id}/`` (multi-user). Try both.
+    """
+    thumb_base = Path("/data/thumbs")
+    # Try legacy flat path first.
+    thumb_path = thumb_base / photo_id / f"{size}.webp"
     if not thumb_path.exists():
-        logger.warning("Thumbnail not found: %s", thumb_path)
-        return None
+        # Try user-prefixed paths: /data/thumbs/*/photo_id/size.webp
+        matches = list(thumb_base.glob(f"*/{photo_id}/{size}.webp"))
+        if matches:
+            thumb_path = matches[0]
+        else:
+            logger.warning("Thumbnail not found: %s", thumb_path)
+            return None
     try:
         img = Image.open(thumb_path).convert("RGB")
         img.load()  # force decode to catch corruption early