core, web: pin, archive and reorder a note someone shared with you

Schema v12 adds notes.state_at: a recipient's own pin, archive and order are
stamped there instead of on updated_at, which stays the text's time. Push sends
them only to a server advertising `shared_state` (push::Accepts), a view share
included; the first pull at that level starts the feed over once so held copies
drop their owner's pins. The client speaks protocol 7 and lists `shares` and
`shared_state` among the features a server may lack.

The web card and editor offer pin, archive and drag on shared notes; share and
trash stay the owner's, and the board's trash key skips notes you don't own.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

core/src/sync/compat.rs

@@ -25,7 +25,10 @@ use std::sync::OnceLock;
 /// on [`MIN_SERVER_PROTOCOL_VERSION`].
 /// v5 (#5168): files attached here upload, and removed attachments and previews are
 /// pushed. Additive: both go only to a server advertising `attachment_sync`.
-pub const CLIENT_PROTOCOL_VERSION: u32 = 5;
+/// v6 (#5175): notes shared with this account, asked for with `shares`.
+/// v7 (#5176): this account's own pin, archive and position on a shared note, sent
+/// only to a server advertising `shared_state`.
+pub const CLIENT_PROTOCOL_VERSION: u32 = 7;
 
 /// The oldest server protocol this client can drive — the symmetric half of the
 /// server's `min_client_protocol_version`.
@@ -49,8 +52,14 @@ pub const REQUIRED_FEATURES: &[&str] = &["notes", "labels"];
 /// Capabilities whose absence costs a feature but not the link. Listing these
 /// explicitly (rather than diffing against whatever the server happens to send) is
 /// what lets the UI name exactly what the user will be missing.
-pub const OPTIONAL_FEATURES: &[&str] =
-    &["attachments", "tombstones", "revisions", "attachment_sync"];
+pub const OPTIONAL_FEATURES: &[&str] = &[
+    "attachments",
+    "tombstones",
+    "revisions",
+    "attachment_sync",
+    "shares",
+    "shared_state",
+];
 
 /// The handshake fields of `GET /api/config`.
 ///