core, web: pin, archive and reorder a note someone shared with you

Schema v12 adds notes.state_at: a recipient's own pin, archive and order are
stamped there instead of on updated_at, which stays the text's time. Push sends
them only to a server advertising `shared_state` (push::Accepts), a view share
included; the first pull at that level starts the feed over once so held copies
drop their owner's pins. The client speaks protocol 7 and lists `shares` and
`shared_state` among the features a server may lack.

The web card and editor offer pin, archive and drag on shared notes; share and
trash stay the owner's, and the board's trash key skips notes you don't own.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

core/src/sync/engine.rs

@@ -50,13 +50,26 @@ pub async fn run_cycle(
     // Notes shared with this account come only from a server offering `shares`, and
     // an unanswered probe reads as "not offered", like `attachment_sync` above.
     let shares = server.as_ref().is_some_and(|s| s.has_feature("shares"));
+    // A recipient's own pin, archive and order on a shared note go only to a server
+    // that keeps them per person; an older one would apply them to nobody.
+    let accepts = push::Accepts {
+        attachment_sync,
+        shared_state: server
+            .as_ref()
+            .is_some_and(|s| s.has_feature("shared_state")),
+    };
 
-    let push = push::run(db, blobs, base_url, token, attachment_sync).await?;
+    let push = push::run(db, blobs, base_url, token, accepts).await?;
     if shares {
         // After the push, so nothing unsent is waiting when the full pull lands.
+        let level = if accepts.shared_state {
+            state::SHARED_STATE
+        } else {
+            state::SHARES
+        };
         let conn = db.0.lock().map_err(|e| e.to_string())?;
-        if state::begin_shares(&conn).map_err(|e| e.to_string())? {
-            log::info!("the server shares notes now; pulling everything once to find them");
+        if state::begin_shares(&conn, level).map_err(|e| e.to_string())? {
+            log::info!("the server shares more of notes now; pulling everything once");
         }
     }
     let pull = pull::run(db, blobs, base_url, token, shares).await?;