diagram sharing: pending grants for unregistered grantee emails

[fabracht]

Follow-up to diagram sharing phase 1 (#76). Phase 1 resolves grantee emails to canonical ids for already-registered users only (resolve-existing); sharing with an unregistered email returns 404.

Scope

• Allow sharing with a not-yet-registered email: store a pending grant (grantee = null, grantee_key = email). A null grantee matches nobody, so the grant is inert until filled.
• On the grantee's first sign-in, sweep _shares by grantee_key = email and fill grantee = canonical_id (in resolve_or_create_identity).
• Preserve the original email in grantee_key at share time (phase 1 currently stores the resolved canonical id there in OAuth mode).

References

• Design: docs/design/diagram-sharing.md
• Phase 1 plan: docs/design/diagram-sharing-phase1-plan.md (grantee resolution, step 1c-ii)
• Phase 1: add agent-mode diagram sharing #76