Multi-user sharing, groups, and in-app notifications

Backend:
- Alembic migration 0025: groups, group_memberships, project_shares,
  note_shares, notifications tables
- models: Group, GroupMembership, ProjectShare, NoteShare, Notification
- services/access.py: permission resolution (viewer/editor/admin/owner)
- services/groups.py + routes/groups.py: full group CRUD + membership
- services/sharing.py + routes/shares.py: project/note sharing API
- services/notifications.py: in-app notification create/list/mark-read
- routes/in_app_notifications.py: GET/POST notification endpoints
- routes/users.py: user search endpoint
- services/projects.py + services/notes.py: *_for_user variants
- routes updated to use *_for_user on get/list; adds permission field
- app.py: register all new blueprints

Frontend:
- api/client.ts: ShareEntry, GroupEntry, NotificationEntry types + helpers
- stores/notifications.ts: Pinia store with polling
- NotificationBell.vue: bell icon + badge + dropdown toggle + 60s poll
- NotificationsPanel.vue: unread notification list with mark-all-read
- ShareDialog.vue: teleport modal for sharing projects/notes with users/groups
- SharedWithMeView.vue: /shared route listing shared projects and notes
- AppHeader: NotificationBell, Shared nav link
- ProjectView, NoteViewerView, TaskViewerView: Share button + ShareDialog
- SettingsView: Groups admin tab with create/delete groups + member mgmt
- router: /shared route

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

frontend/src/components/NotificationsPanel.vue

@@ -0,0 +1,156 @@
+<script setup lang="ts">
+import { onMounted } from 'vue'
+import { useRouter } from 'vue-router'
+import { useNotificationsStore } from '@/stores/notifications'
+import { relativeTime } from '@/composables/useRelativeTime'
+
+const emit = defineEmits<{ close: [] }>()
+const store = useNotificationsStore()
+const router = useRouter()
+
+const typeIcon: Record<string, string> = {
+  project_shared: '📁',
+  note_shared: '📝',
+  group_added: '👥',
+}
+
+async function handleClick(notif: { id: number; payload: Record<string, unknown> }) {
+  await store.markRead(notif.id)
+  const url = notif.payload.url as string | undefined
+  if (url) {
+    emit('close')
+    router.push(url)
+  }
+}
+
+onMounted(() => store.fetchAll())
+</script>
+
+<template>
+  <div class="notif-panel" role="dialog" aria-label="Notifications">
+    <header class="notif-panel-header">
+      <span class="notif-panel-title">Notifications</span>
+      <button
+        v-if="store.count > 0"
+        class="btn-mark-all"
+        @click="store.markAll()"
+      >Mark all read</button>
+    </header>
+
+    <ul class="notif-list" v-if="store.items.length">
+      <li
+        v-for="n in store.items"
+        :key="n.id"
+        class="notif-item"
+        @click="handleClick(n)"
+      >
+        <span class="notif-icon">{{ typeIcon[n.type] ?? '🔔' }}</span>
+        <div class="notif-body">
+          <p class="notif-msg">
+            <strong v-if="n.payload.invited_by">{{ n.payload.invited_by }}</strong>
+            {{ n.type === 'project_shared'
+                ? ` shared "${n.payload.project_title}" with you as ${n.payload.permission}`
+                : n.type === 'note_shared'
+                  ? ` shared "${n.payload.note_title}" with you as ${n.payload.permission}`
+                  : ` added you to "${n.payload.group_name}" as ${n.payload.role}` }}
+          </p>
+          <span class="notif-time">{{ relativeTime(n.created_at) }}</span>
+        </div>
+        <button class="btn-notif-close" @click.stop="store.markRead(n.id)" aria-label="Dismiss">✕</button>
+      </li>
+    </ul>
+    <div v-else class="notif-empty">No unread notifications</div>
+  </div>
+</template>
+
+<style scoped>
+.notif-panel {
+  position: absolute;
+  top: calc(100% + 8px);
+  right: 0;
+  width: 340px;
+  max-height: 400px;
+  overflow-y: auto;
+  background: var(--color-surface);
+  border: 1px solid var(--color-border);
+  border-radius: var(--radius-lg);
+  box-shadow: 0 12px 40px rgba(0, 0, 0, 0.18);
+  z-index: 500;
+}
+
+.notif-panel-header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 0.75rem 1rem;
+  border-bottom: 1px solid var(--color-border);
+  position: sticky;
+  top: 0;
+  background: var(--color-surface);
+}
+
+.notif-panel-title {
+  font-weight: 700;
+  font-size: 0.9rem;
+}
+
+.btn-mark-all {
+  background: none;
+  border: none;
+  color: var(--color-primary);
+  font-size: 0.78rem;
+  cursor: pointer;
+  padding: 0;
+}
+.btn-mark-all:hover { text-decoration: underline; }
+
+.notif-list {
+  list-style: none;
+  padding: 0;
+  margin: 0;
+}
+
+.notif-item {
+  display: flex;
+  align-items: flex-start;
+  gap: 0.6rem;
+  padding: 0.75rem 1rem;
+  border-bottom: 1px solid var(--color-border);
+  cursor: pointer;
+  transition: background 0.1s;
+}
+.notif-item:last-child { border-bottom: none; }
+.notif-item:hover { background: var(--color-hover); }
+
+.notif-icon { font-size: 1.2rem; flex-shrink: 0; margin-top: 0.1rem; }
+
+.notif-body { flex: 1; min-width: 0; }
+.notif-msg {
+  margin: 0 0 0.2rem;
+  font-size: 0.85rem;
+  color: var(--color-text);
+  line-height: 1.4;
+  word-break: break-word;
+}
+.notif-time { font-size: 0.75rem; color: var(--color-muted); }
+
+.btn-notif-close {
+  background: none;
+  border: none;
+  color: var(--color-muted);
+  cursor: pointer;
+  font-size: 0.8rem;
+  padding: 0.1rem 0.25rem;
+  flex-shrink: 0;
+  transition: color 0.1s;
+}
+.btn-notif-close:hover { color: var(--color-text); }
+
+.notif-empty {
+  padding: 1.5rem;
+  text-align: center;
+  color: var(--color-muted);
+  font-size: 0.88rem;
+  font-style: italic;
+}
+</style>