完善共享授权与本地同步闭环

实现独立 share-grants 控制面，区分产品分享授权与本机目录授权。

收紧 shared AI session 的资源范围，并补充 shared cache、pending change 与冲突报告 sidecar。

更新当前架构与执行 checklist，记录 P4 已完成项和剩余 browser smoke。

rust/crates/mnote-web/src/routes/mod.rs

@@ -127,6 +127,27 @@ pub fn build_router(state: AppState) -> Router {
             "/api/admin/access-policy/grants/{grant_id}",
             delete(local_folder_source::delete_local_access_grant),
         )
+        .route(
+            "/api/admin/share-grants",
+            get(local_folder_source::get_share_grants)
+                .post(local_folder_source::create_share_grant),
+        )
+        .route(
+            "/api/admin/share-grants/{share_id}",
+            delete(local_folder_source::delete_share_grant),
+        )
+        .route(
+            "/api/local-folder/shared-cache/record",
+            post(local_folder_source::record_shared_cache),
+        )
+        .route(
+            "/api/local-folder/sync/pending-change",
+            post(local_folder_source::record_sync_pending_change),
+        )
+        .route(
+            "/api/local-folder/sync/conflict-report",
+            post(local_folder_source::write_sync_conflict_report),
+        )
         .route("/api/ai-agent/run", post(compat::next_ai_agent_run))
         .route(
             "/api/page-ai/block-edit-workflow",