feat: public shopping list links can allow editing

Owner opts in per-list via a new "Allow editing" toggle next to the
existing public-link switch. Anonymous writes are scoped to that one
list only — the link id is the sole credential, enforced in
getShoppingListAccess and the item routes (no session required there
now), with an IP rate limit on genuinely anonymous requests. Turning
off the public link also revokes editing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

apps/web/lib/shopping-list-access.ts

@@ -7,21 +7,32 @@ export type ShoppingListAccess = {
   role: ShoppingListRole;
 };
 
-/** Resolves a user's access to a shopping list — owner, or member with their assigned role. Null if no access. */
+/**
+ * Resolves access to a shopping list — owner, member with their assigned role,
+ * or (when `userId` is null, i.e. no session) an anonymous visitor via the
+ * public link: "editor" if the owner enabled public editing, "viewer" if the
+ * list is merely public, else no access. The link's id is the only credential
+ * an anonymous visitor has, so this must never fall through to a real role
+ * for a non-public list.
+ */
 export async function getShoppingListAccess(
   listId: string,
-  userId: string
+  userId: string | null
 ): Promise<ShoppingListAccess | null> {
   const list = await db.query.shoppingLists.findFirst({ where: eq(shoppingLists.id, listId) });
   if (!list) return null;
-  if (list.userId === userId) return { list, role: "owner" };
 
-  const member = await db.query.shoppingListMembers.findFirst({
-    where: and(eq(shoppingListMembers.listId, listId), eq(shoppingListMembers.userId, userId)),
-  });
-  if (!member) return null;
+  if (userId) {
+    if (list.userId === userId) return { list, role: "owner" };
 
-  return { list, role: member.role };
+    const member = await db.query.shoppingListMembers.findFirst({
+      where: and(eq(shoppingListMembers.listId, listId), eq(shoppingListMembers.userId, userId)),
+    });
+    if (member) return { list, role: member.role };
+  }
+
+  if (!list.isPublic) return null;
+  return { list, role: list.publicEditable ? "editor" : "viewer" };
 }
 
 export function canWriteShoppingList(role: ShoppingListRole): boolean {