feat(chat): share a chat by link — anonymous read-only /shared/<token> page, share/unshare

app/models.py

@@ -21,7 +21,9 @@ Data model — see ``.agent/PLAN.md`` §Data Model:
                       explicitly Saved conversation (auto-``title`` +
                       the ``bor.chat.v1`` message list as JSONB, phase
                       14 shape) — phase 50; ``/api/chat`` stays
-                      stateless.
+                      stateless; ``share_token`` (NULL = private,
+                      ``uuid4`` = publicly readable at
+                      ``/shared/<token>``) — phase 51.
 """
 from __future__ import annotations
 
@@ -178,8 +180,7 @@ class SavedChat(Base):
     saved. ``messages`` holds the exact ``bor.chat.v1`` localStorage
     record shape (phase 14 — raw text, never HTML), so a saved chat
     restores pixel-identical through the existing
-    ``renderStoredMessage`` path. No share-related columns here —
-    phase 51 adds ``share_token`` in migration 0009.
+    ``renderStoredMessage`` path.
     """
 
     __tablename__ = "saved_chats"
@@ -193,6 +194,15 @@ class SavedChat(Base):
     #: tools?, stopped?}``); the API always supplies a list, so no
     #: default is needed.
     messages: Mapped[list] = mapped_column(JSONB)
+    #: Anonymous share link (phase 51): a 128-bit ``uuid4`` token; when
+    #: set, the chat is publicly readable at ``/shared/<token>`` without
+    #: any admin session, and unsharing (token → NULL) revokes it.
+    #: Unique — Postgres treats NULLs as distinct under a unique index
+    #: (the ``git_sources.path`` precedent, phase 38), so any number of
+    #: unshared chats coexist while two identical tokens can never exist.
+    share_token: Mapped[uuid.UUID | None] = mapped_column(
+        UUID(as_uuid=True), unique=True, nullable=True
+    )
     created_at: Mapped[datetime] = mapped_column(DateTime(timezone=True), server_default=func.now())
     updated_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True), server_default=func.now(), onupdate=func.now()