feat(tasks): add read-only sharing permission for task lists

Task list shares now carry a permission (editor/viewer). The server rejects
writes from viewers with 403, and the UI hides or disables edit controls
for read-only lists.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

internal/domain/models.go

@@ -184,6 +184,7 @@ type TaskListShare struct {
 	TargetName string `json:"targetName,omitempty"`
 	Email      string `json:"email,omitempty"`
 	AvatarURL  string `json:"avatarUrl,omitempty"`
+	Permission string `json:"permission"` // editor | viewer
 	CreatedAt  string `json:"createdAt"`
 }
 
@@ -211,6 +212,7 @@ type TaskList struct {
 	TeamName   string           `json:"teamName,omitempty"`
 	OwnerName  string           `json:"ownerName,omitempty"`
 	IsOwner    bool             `json:"isOwner"`
+	Permission string           `json:"permission,omitempty"` // owner | editor | viewer
 	Members    []TaskListMember `json:"members,omitempty"`
 	Shares     []TaskListShare  `json:"shares,omitempty"`
 	Columns    []KanbanColumn   `json:"columns,omitempty"`