Add diagram sharing/collaborators, version history, and view-only lockdown

Per organized-ideas.md §8. Backend tables/RLS (diagrams, diagram_collaborators,
diagram_snapshots) already existed from an earlier phase — this is the
frontend for them, plus two small backend additions.

Backend (supabase/migrations/20260913000000_diagram_sharing.sql):
- find_user_id_by_username(text): lets any authenticated user resolve a
  username to an id for "share with @username" — unlike general profile
  browsing (blocked by profiles_select_self_or_super_admin), a username is
  meant to be a shareable handle, so this is deliberately not gated.
- diagram_collaborator_usernames / diagram_snapshot_saved_by_usernames:
  same pattern as the admin-review-queue phase's submitter-username
  lookup — batched per diagram, gated to "can you see this diagram at all"
  (reusing diagrams_select's own helper functions).
- prune_diagram_snapshots trigger: keeps the 50 most recent snapshots per
  diagram, enforced at write time rather than a scheduled job (diagram_
  snapshots has no update/delete policy for regular users at all).
- 14 new pgTAP tests (52/52 total).

Frontend:
- DiagramCollaboratorRepository/store + DiagramSharingModal: add/remove
  collaborators by username, per-person view/edit permission, owner-only
  controls.
- DiagramSnapshotRepository/store + VersionHistoryModal (its own top-bar
  button, not nested under Share — moved there after review): periodic
  checkpoints (one per 5 min of active editing) written as a side effect
  of normal saves, list + restore.
- Restore's duplicate-snapshot problem: repeatedly jumping between old
  versions without editing in between was writing a near-duplicate safety
  snapshot on every jump. Fixed by having projectStore track which
  snapshot the diagram was last restored from and its updatedAt at that
  moment (touch() always advances updatedAt on a genuine edit) — a restore
  skips the safety snapshot when nothing has changed since the last one,
  and the tracking clears on any real edit so in-progress work stays
  protected.
- DiagramRepository gains getAccess() (owner id + your own permission for
  the open diagram) — surfaced in projectStore as `access`.
- View-only enforcement: FlowCanvas disables drag/connect/drop
  (nodesDraggable/nodesConnectable + guarded handlers), DeviceInspector/
  ConnectionInspector wrap their controls in a disabled <fieldset>,
  DevicePalette disables adding devices to the canvas, TopBar disables the
  rename field, and a ViewOnlyBanner makes the restriction visible instead
  of leaving a collaborator to discover it as controls that just don't
  work. Autosave itself also refuses to write for a view-only user, as a
  backstop behind the UI-level lockdown.

Verified: tsc -b and oxlint clean; supabase db reset + 52/52 pgTAP tests
pass; confirmed find_user_id_by_username works through the real REST API
via a live curl call (signup, confirm, resolve). Manually tested two-
account sharing (view vs. edit), restoring history, and the duplicate-
snapshot fix.

src/components/layout/TopBar.tsx

@@ -6,6 +6,8 @@ import { useAuthStore } from '../../state/authStore'
 import { useProjectStore } from '../../state/projectStore'
 import { useSubmissionStore } from '../../state/submissionStore'
 import AdminUsersModal from '../admin/AdminUsersModal'
+import DiagramSharingModal from '../sharing/DiagramSharingModal'
+import VersionHistoryModal from '../sharing/VersionHistoryModal'
 import AdminReviewModal from '../submissions/AdminReviewModal'
 import MySubmissionsModal from '../submissions/MySubmissionsModal'
 import DiagramManagerModal from './DiagramManagerModal'
@@ -32,6 +34,8 @@ function setLastSeenSubmissionsAt(iso: string): void {
 
 export default function TopBar() {
   const project = useProjectStore((s) => s.project)
+  const access = useProjectStore((s) => s.access)
+  const canEdit = access?.myPermission !== 'view'
   const renameProject = useProjectStore((s) => s.renameProject)
   const importProject = useProjectStore((s) => s.importProject)
   const mySubmissions = useSubmissionStore((s) => s.mySubmissions)
@@ -42,6 +46,8 @@ export default function TopBar() {
   const adminPendingCount = useAdminReviewStore((s) => s.allSubmissions.filter((sub) => sub.status === 'pending').length)
   const fileInputRef = useRef<HTMLInputElement>(null)
   const [diagramManagerOpen, setDiagramManagerOpen] = useState(false)
+  const [versionHistoryOpen, setVersionHistoryOpen] = useState(false)
+  const [sharingOpen, setSharingOpen] = useState(false)
   const [submissionsOpen, setSubmissionsOpen] = useState(false)
   const [adminReviewOpen, setAdminReviewOpen] = useState(false)
   const [adminUsersOpen, setAdminUsersOpen] = useState(false)
@@ -84,7 +90,8 @@ export default function TopBar() {
         <input
           value={project.name}
           onChange={(e) => renameProject(e.target.value)}
-          className="rounded border border-transparent px-2 py-1 text-sm text-slate-700 hover:border-slate-200 focus:border-slate-300 focus:outline-none"
+          disabled={!canEdit}
+          className="rounded border border-transparent px-2 py-1 text-sm text-slate-700 hover:border-slate-200 focus:border-slate-300 focus:outline-none disabled:cursor-not-allowed disabled:opacity-60"
         />
       </div>
       <div className="flex items-center gap-1.5">
@@ -94,6 +101,18 @@ export default function TopBar() {
         >
           Diagrams
         </button>
+        <button
+          onClick={() => setVersionHistoryOpen(true)}
+          className="rounded px-2.5 py-1.5 text-xs text-slate-600 hover:bg-slate-100"
+        >
+          History
+        </button>
+        <button
+          onClick={() => setSharingOpen(true)}
+          className="rounded px-2.5 py-1.5 text-xs text-slate-600 hover:bg-slate-100"
+        >
+          Share
+        </button>
         <button onClick={openMySubmissions} className="rounded px-2.5 py-1.5 text-xs text-slate-600 hover:bg-slate-100">
           My Submissions
           {unseenOutcomeCount > 0 ? (
@@ -151,6 +170,8 @@ export default function TopBar() {
         </button>
       </div>
       {diagramManagerOpen && <DiagramManagerModal onClose={() => setDiagramManagerOpen(false)} />}
+      {versionHistoryOpen && <VersionHistoryModal onClose={() => setVersionHistoryOpen(false)} />}
+      {sharingOpen && <DiagramSharingModal onClose={() => setSharingOpen(false)} />}
       {submissionsOpen && <MySubmissionsModal onClose={() => setSubmissionsOpen(false)} />}
       {adminReviewOpen && <AdminReviewModal onClose={() => setAdminReviewOpen(false)} />}
       {adminUsersOpen && <AdminUsersModal onClose={() => setAdminUsersOpen(false)} />}