feat(server-mode): share a workspace with other users (sharing phase 1)

A workspace's owner (or an admin) shares it from its ⋯ menu → Share…
(lane_shares, GET/PUT /api/lanes/:id/shares, audited). The users it is shared
with see it, its sessions, Changes, history and live updates, join and type
into its open terminals, commit and push — every check through scope.js
(canSeeLane, sessionWhere, laneWhere, broadcastAudience viewers). Rename,
reset, remove, delete and sharing stay the owner's or an admin's
(403 ENOTOWNER), and a collaborator starts no AI session there yet
(403 ECOLLABSTART; a plain terminal tab is fine). Budgets and Today stay on
owned rows only (ownedOnlySessionWhere). Taking a share back sends lane_access
to those users and their terminals close at the next attach re-check.

Under S3 a collaborator works as the owner's Linux account; the Share dialog
says so plainly (docs/plans/workspace-sharing/, R1 option a).

docs/API.md

@@ -2098,6 +2098,23 @@ POST /api/locks/:name/release
 - **409** `{ "error": { "code": "ENOTHOLDER", "message": "...", "currentHolder": "lane1" } }` — `holder` doesn't match the current owner; a release never trusts its caller, same rule every other destructive path in this project follows.
 - **404** `{ "error": { "code": "ENOLOCK", "message": "no such lock: build" } }` — nothing by that name is held.
 
+#### Sharing a workspace (server mode)
+
+```http
+GET /api/lanes/:id/shares                → { shares: [{id, username, name, sharedAt}], canManage }
+PUT /api/lanes/:id/shares  {"userIds": [2, 5]}   → { shares }
+```
+
+The users a workspace is shared with (`lane_shares`, names only). `PUT` takes the
+WHOLE list — at most 200 enabled users, never the owner (`400 EBADUSER`) — from the
+owner or an admin only (`403 ENOTOWNER`), same-origin, each change audited. Local
+mode: `GET` answers an empty list, `PUT` `400 ELOCALMODE`. A user it is shared with
+sees and works in it like its owner, but `PATCH {title}`, `reset`/`remove`/`purge`,
+`DELETE` and `PUT …/shares` answer them `403 ENOTOWNER`, and a non-shell
+`POST /api/lanes/:id/start` or `POST /api/run` `403 ECOLLABSTART`. Users taken off
+get the WebSocket message `lane_access` `{laneId, userIds}` (sent to them only). See
+`docs/SERVER-MODE.md` → Sharing a workspace.
+
 #### Workspace context: instructions, folders, context files, memory
 
 ```http