feat: organizations decide who sees whom; sharing only by owners

- Server admins manage organizations (one per user); new admin section,
  organization on user creation and invites, setup creates the first one
- Sharing modes private / organizations / open, enforced centrally
  (CanSee, CanShareWith) for directory, all shares and groups; unknown and
  invisible targets give the same error
- Losing visibility (org change, mode change, leaving a group) prunes shares,
  group memberships and task assignments; dry run warns before tightening
- Only owners share; editors can no longer reshare lists or remove others'
  shares; legacy task_lists.team_id and old /organizations endpoints removed
  (FLAW-06, FLAW-10, FLAW-24)
- Schema version: outdated databases are wiped and recreated on start
- Fix setup sample data (createSampleData was ignored); setup and admin
  use a shared ToggleSwitch instead of checkboxes
- Docs: sharing-and-permissions rewritten, ui-patterns, REST, DB, flaws

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

internal/storage/docsync_test.go

@@ -13,6 +13,7 @@ import (
 func newSyncTestStore(t *testing.T) (*Store, *domain.User) {
 	t.Helper()
 	store, err := NewStore(filepath.Join(t.TempDir(), "sync.db"))
+	openSharing(t, store)
 	if err != nil {
 		t.Fatalf("store: %v", err)
 	}