sync: shared notes in the feed, revocations, and text pushes from an edit share

The change feed answers `?shares=1` with every note the caller can see, each
saying how it is held, plus a `revoked` list of notes that left them. Granting
a share moves the note past the recipient's cursor; ending one, or the owner
deleting the note, leaves a revocation on the same cursor. A recipient at edit
may push the note's text, and nothing else. Protocol 6, feature `shares`;
opt-in, so the floor stays at 3.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

alembic/versions/0035_share_revocations.py

@@ -0,0 +1,50 @@
+"""share_revocations: telling a recipient's devices a shared note has left them
+
+Revision ID: 0035
+Revises: 0034
+Create Date: 2026-10-07
+
+The change feed carries every note a person can see, including notes shared with
+them (#5175). When a share ends, the note stops being visible, so it simply stops
+appearing in the feed. A device that already holds a copy would keep it forever. A
+revocation is that missing signal: one row per (note, person) who lost the note,
+stamped from the same `sync_revision_seq` the notes and labels draw from, so it sits
+on the one cursor every client already pages by.
+
+Sharing the note with that person again deletes the row, so a device that never
+heard of the revocation never gets told to delete a note it is meant to have.
+
+## Downgrade
+
+Drops the table. Devices that missed a revocation keep their copy.
+"""
+import sqlalchemy as sa
+from alembic import op
+from sqlalchemy.dialects.postgresql import UUID
+
+revision = "0035"
+down_revision = "0034"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "share_revocations",
+        sa.Column("note_id", UUID(as_uuid=True), sa.ForeignKey("notes.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("user_id", UUID(as_uuid=True), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
+        sa.Column(
+            "sync_revision",
+            sa.BigInteger(),
+            nullable=False,
+            server_default=sa.text("nextval('sync_revision_seq')"),
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), nullable=False, server_default=sa.func.now()),
+        sa.PrimaryKeyConstraint("note_id", "user_id"),
+    )
+    op.create_index("ix_share_revocations_user_revision", "share_revocations", ["user_id", "sync_revision"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_share_revocations_user_revision", table_name="share_revocations")
+    op.drop_table("share_revocations")