Implement Phase 4: gRPC sync service

- Proto definitions (engpad.v1.EngPadSync) with 6 RPCs
- Generated Go gRPC code
- Auth interceptor: username/password from metadata
- SyncNotebook: upsert with full page/stroke replacement in a tx
- DeleteNotebook, ListNotebooks handlers
- Share link RPCs: CreateShareLink, RevokeShareLink, ListShareLinks
- Share link token management (32-byte random, optional expiry)
- gRPC server with TLS 1.3

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

internal/grpcserver/share.go

@@ -0,0 +1,94 @@
+package grpcserver
+
+import (
+	"context"
+	"database/sql"
+	"time"
+
+	pb "git.wntrmute.dev/kyle/eng-pad-server/gen/engpad/v1"
+	"git.wntrmute.dev/kyle/eng-pad-server/internal/share"
+	"google.golang.org/grpc/codes"
+	"google.golang.org/grpc/status"
+	"google.golang.org/protobuf/types/known/timestamppb"
+)
+
+func (s *SyncService) CreateShareLink(ctx context.Context, req *pb.CreateShareLinkRequest) (*pb.CreateShareLinkResponse, error) {
+	userID, ok := UserIDFromContext(ctx)
+	if !ok {
+		return nil, status.Error(codes.Internal, "missing user context")
+	}
+
+	// Verify notebook belongs to user
+	var notebookID int64
+	err := s.DB.QueryRowContext(ctx,
+		"SELECT id FROM notebooks WHERE user_id = ? AND remote_id = ?",
+		userID, req.NotebookId,
+	).Scan(&notebookID)
+	if err == sql.ErrNoRows {
+		return nil, status.Error(codes.NotFound, "notebook not found")
+	} else if err != nil {
+		return nil, status.Errorf(codes.Internal, "query: %v", err)
+	}
+
+	var expiry time.Duration
+	if req.ExpiresInSeconds > 0 {
+		expiry = time.Duration(req.ExpiresInSeconds) * time.Second
+	}
+
+	token, expiresAt, err := share.CreateLink(s.DB, notebookID, expiry, s.BaseURL)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "create link: %v", err)
+	}
+
+	resp := &pb.CreateShareLinkResponse{
+		Token: token,
+		Url:   s.BaseURL + "/s/" + token,
+	}
+	if expiresAt != nil {
+		resp.ExpiresAt = timestamppb.New(*expiresAt)
+	}
+	return resp, nil
+}
+
+func (s *SyncService) RevokeShareLink(ctx context.Context, req *pb.RevokeShareLinkRequest) (*pb.RevokeShareLinkResponse, error) {
+	if err := share.RevokeLink(s.DB, req.Token); err != nil {
+		return nil, status.Errorf(codes.Internal, "revoke: %v", err)
+	}
+	return &pb.RevokeShareLinkResponse{}, nil
+}
+
+func (s *SyncService) ListShareLinks(ctx context.Context, req *pb.ListShareLinksRequest) (*pb.ListShareLinksResponse, error) {
+	userID, ok := UserIDFromContext(ctx)
+	if !ok {
+		return nil, status.Error(codes.Internal, "missing user context")
+	}
+
+	var notebookID int64
+	err := s.DB.QueryRowContext(ctx,
+		"SELECT id FROM notebooks WHERE user_id = ? AND remote_id = ?",
+		userID, req.NotebookId,
+	).Scan(&notebookID)
+	if err != nil {
+		return nil, status.Error(codes.NotFound, "notebook not found")
+	}
+
+	links, err := share.ListLinks(s.DB, notebookID, s.BaseURL)
+	if err != nil {
+		return nil, status.Errorf(codes.Internal, "list: %v", err)
+	}
+
+	var pbLinks []*pb.ShareLinkInfo
+	for _, l := range links {
+		pbl := &pb.ShareLinkInfo{
+			Token:     l.Token,
+			Url:       l.URL,
+			CreatedAt: timestamppb.New(l.CreatedAt),
+		}
+		if l.ExpiresAt != nil {
+			pbl.ExpiresAt = timestamppb.New(*l.ExpiresAt)
+		}
+		pbLinks = append(pbLinks, pbl)
+	}
+
+	return &pb.ListShareLinksResponse{Links: pbLinks}, nil
+}