feat: shareable shopping list links with token-based guest access

- Generate temporary share links (default 24h) that allow unauthenticated
  users to view and edit the shopping list
- Share token management modal: create, copy, delete, and adjust TTL
- Token auth bypasses hooks middleware for /cospend/list routes only
- Guest users see only the Liste nav item, other cospend tabs are hidden
- All list API endpoints accept ?token= query param as alternative auth
- MongoDB TTL index auto-expires tokens

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/hooks.server.ts

@@ -39,6 +39,16 @@ async function authorization({ event, resolve }: Parameters<Handle>[0]) {
 	// Protect cospend routes and API endpoints
 	if (event.url.pathname.startsWith('/cospend') || event.url.pathname.startsWith('/api/cospend')) {
 		if (!session) {
+			// Allow share-token access to shopping list routes
+			const isShoppingRoute = event.url.pathname.startsWith('/cospend/list') || event.url.pathname.startsWith('/api/cospend/list');
+			const shareToken = event.url.searchParams.get('token');
+			if (isShoppingRoute && shareToken) {
+				const { validateShareToken } = await import('$lib/server/shoppingAuth');
+				if (await validateShareToken(shareToken)) {
+					return resolve(event);
+				}
+			}
+
 			// For API routes, return 401 instead of redirecting
 			if (event.url.pathname.startsWith('/api/cospend')) {
 				error(401, {