Arnaud
a1a11ff5e5
Mirrors the existing recipe public-share pattern (/r/[id], gated by a visibility flag, no auth required) — shopping lists previously only supported private per-user collaborator invites (email + viewer/editor role), with no way to hand someone a link who isn't already a member. - shoppingLists.isPublic (owner-only toggle, same access-control pattern already used for renaming/deleting the list). - New public /s/[id] route added to PUBLIC_PATHS — read-only aisle-grouped view with a signup CTA for logged-out visitors, styled after /r/[id]. - The existing collaborator-invite dialog (ShareShoppingListButton) now also has a "Public link" toggle + copy-link button at the top, so there's one Share entry point for both private and public sharing. Verified locally: toggling public via the real dialog UI persists correctly (confirmed via DB + a fresh curl PATCH to rule out a client race in my own test script), and the public link loads with zero auth for a logged-out browser context.