feat: share dialog, SharedMaps feature flag, publish toggle rename

[joaquimds]

Summary

The final piece of read-only private map sharing — stage 6 of the plan in READ_ONLY_PRIVATE_MAPS.md, completing the feature started in #468 (backend) and #469 (viewer + password gate). Adds the owner-facing controls: the Share button and dialog, the Feature.SharedMaps organisation flag, and the toggle rename that frees the word "share" for this feature.

What's included

ShareMapDialog — a Share button in the private map navbar opening a popover:

• Read-only link switch: enabling creates the share (or re-enables it, keeping the same link); disabling revokes all viewer access instantly.
• Require a password switch: set, change, or remove the password (min 8 chars, matching the account-password rules). The copy warns that changing/removing it signs current viewers out — which the backend enforces via passwordUpdatedAt.
• Link row: copy-to-clipboard, plus a Reset link action that rotates the token so the old URL stops working (for leaked links).

All state flows through the mapShare tRPC router from #468; mutations return the fresh share state, which is written straight into the query cache (no refetches).

Feature.SharedMaps — new organisation feature flag gating the Share button, following the Feature.PublicMaps precedent. As with all flags, development mode enables it unconditionally. The /share/[token] route itself is not flag-gated, so existing links keep working if an org's flag is later turned off (per the plan's open-question resolution).

Toggle rename — MapModeToggle's "Share" tab is now "Publish". Both the editor and publish-mode navbars render the same component, so the single rename covers both. Copy audit found no other user-facing text calling publishing "share" (the "Shared Care Agreement" strings in the publish constants are domain data, not UI copy).

Test plan

• npm run lint clean (prettier, eslint, tsc, madge)
• All 40 share backend tests still pass
• Manual (stage 6 checkpoint): full end-to-end flow from the dialog — enable the link, copy it, open it logged out; set a password and confirm the incognito flow; change the password and confirm an open viewer session is booted; reset the link and confirm the old URL 404s; disable and confirm viewers lose access

Notes for reviewers

• The dialog is a popover (Figma/Google-Docs-style lightweight sharing) rather than a modal; Radix unmounts the content on close, so transient password-editing state resets naturally.
• "Reset link" is deliberately a one-click action with a toast rather than a confirm step — the recovery is simply sharing the new link. Note the nuance carried over from feat: read-only private map sharing — backend #468: reset invalidates the URL but not grants already minted from it; viewers age out within 7 days. If reset should also boot active viewers, a grants_revoked_at column is the clean follow-up.
• The dialog intentionally shows nothing but the enable switch until sharing is on — no token is created until the first enable.

🤖 Generated with Claude Code