feat: share heaps and folders with other users, fix auth and vision pipeline

Sharing:
- New HeapShare and FolderShare models with read/write permissions
- Sharing API router (CRUD for heap and folder shares)
- Heap endpoints accept shared access (photo_ids, add/remove with write)
- Photo list drops user_id filter in shared context, adds owner_username
- Media serving (thumb/original/proxy) falls back to share check on 404
- ShareDialog component for managing shares from kebab menus
- HeapsPanel shows "Shared with me" section for shared heaps
- LeftSidebar shows "Shared with me" section for shared folders
- Owner badge on PhotoThumbnail for photos from other users

Auth:
- Access token default bumped to 1 year, refresh to 10 years
- Refresh token persisted in localStorage (survives page reload)
- Timer-based refresh replaced with 401 axios interceptor

Vision pipeline fixes:
- Bootstrap sets Redis ready key even on partial export failure
- Export functions run conditionally (only for actually missing models)
- _load_thumb handles multi-user path (/data/thumbs/{user_id}/{photo_id}/)
- can_access_photo_via_share uses single subquery instead of N+1 loop

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontend/src/services/api.ts

@@ -713,6 +713,69 @@ export const heaps = {
   },
 }
 
+// Sharing API
+
+export interface SharedHeap {
+  id: string
+  name: string
+  owner_username: string
+  permission: 'read' | 'write'
+  photo_count: number
+}
+
+export interface SharedFolder {
+  id: string
+  name: string
+  folder_type: 'folder' | 'source_root'
+  owner_username: string
+  permission: 'read' | 'write'
+  photo_count: number
+}
+
+export interface ShareInfo {
+  id: string
+  shared_with_id: string
+  shared_with_username: string
+  permission: string
+  created_at: string
+}
+
+export const sharing = {
+  // Heap shares
+  shareHeap: async (heapId: string, username: string, permission: 'read' | 'write' = 'read') => {
+    const response = await api.post(`/sharing/heaps/${heapId}`, { username, permission })
+    return response.data
+  },
+  heapShares: async (heapId: string): Promise<ShareInfo[]> => {
+    const response = await api.get(`/sharing/heaps/${heapId}`)
+    return response.data
+  },
+  revokeHeapShare: async (heapId: string, shareId: string) => {
+    await api.delete(`/sharing/heaps/${heapId}/${shareId}`)
+  },
+  sharedHeaps: async (): Promise<SharedHeap[]> => {
+    const response = await api.get('/sharing/heaps/shared-with-me')
+    return response.data
+  },
+
+  // Folder shares
+  shareFolder: async (folderId: string, username: string, permission: 'read' | 'write' = 'read') => {
+    const response = await api.post(`/sharing/folders/${folderId}`, { username, permission })
+    return response.data
+  },
+  folderShares: async (folderId: string): Promise<ShareInfo[]> => {
+    const response = await api.get(`/sharing/folders/${folderId}`)
+    return response.data
+  },
+  revokeFolderShare: async (folderId: string, shareId: string) => {
+    await api.delete(`/sharing/folders/${folderId}/${shareId}`)
+  },
+  sharedFolders: async (): Promise<SharedFolder[]> => {
+    const response = await api.get('/sharing/folders/shared-with-me')
+    return response.data
+  },
+}
+
 // Tags API
 export type TagKind = 'user' | 'object' | 'scene' | 'face_cluster'