feat(tasks): add read-only sharing permission for task lists

Task list shares now carry a permission (editor/viewer). The server rejects
writes from viewers with 403, and the UI hides or disables edit controls
for read-only lists.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

frontend/src/lib/api.ts

@@ -430,7 +430,7 @@ export const api = {
 
   async addTaskListShare(
     id: string,
-    payload: { targetType: 'team' | 'user'; targetId: string }
+    payload: { targetType: 'team' | 'user'; targetId: string; permission?: 'editor' | 'viewer' }
   ): Promise<TaskListShare> {
     return request<TaskListShare>(`/api/v1/task-lists/${id}/shares`, {
       method: 'POST',

frontend/src/lib/types.ts

@@ -83,6 +83,7 @@ export interface TaskListShare {
   targetName?: string;
   email?: string;
   avatarUrl?: string;
+  permission?: 'editor' | 'viewer';
   createdAt: string;
 }
 
@@ -104,6 +105,7 @@ export interface TaskList {
   ownerId?: string;
   ownerName?: string;
   isOwner?: boolean;
+  permission?: 'owner' | 'editor' | 'viewer';
   members?: TaskListMember[];
   shares?: TaskListShare[];
   columns?: KanbanColumn[];