feat: add collaborator and viewer roles to trips and plans

[samrford]

Introduces shared access for trips and plans. Owners stay the only ones
who can delete or change visibility, while contributors can edit content
and viewers can see private resources.

Backend

• New trip_collaborators / plan_collaborators membership tables and
  trip_invites / plan_invites token tables, with foreign-key cascade
  on parent delete.
• data.Role + GetTripAccess / GetPlanAccess helpers replace the
  inline WHERE user_id = $1 checks across trips, plans, checkpoints,
  plan_days, and plan_items.
• ListTrips / ListPlans UNION owned + collaborator rows and return a
  per-row role field; updates preserve is_public for non-owners.
• New collaborators / invites handlers expose CRUD over membership and
  token-based invites with idempotent upgrade-only role on accept.
• makeImageHandler now grants collaborators access to private cover and
  checkpoint photos.

Frontend

• Trip / Plan types gain role; trip & plan list cards show a
  Contributor / Viewer pill; detail pages gate add/edit on canEdit.
• New ShareModal (people list, role dropdowns, direct invite via
  UserPicker, link generation), /invite/[token] landing page, and
  /invitations inbox with sidebar count badge.
• UserSearch is now a thin wrapper over a generic UserPicker.
• Signup and login forward ?next= so post-auth redirects land back on
  the invite page.

Direct invites require explicit acceptance from the recipient. Invite
links never expire by default and have unlimited uses until revoked.