v5.4.1 Partage : correctif permissions + autocomplete membres (inclut v5.4.0 Interactions de bloc)

- Fix "Invalid permission" : le client envoyait editor/commenter/viewer alors que
  l'API attend view/comment/edit (invitePermission -> 'edit', menu participants aligné)
- PUT /api/pages/{page_id}/share/{share_id} : mise à jour de permission persistée
- Autocomplete des membres existants dans le champ d'invitation (search users + debounce,
  navigation clavier, envoi user_id pour lier le partage au compte)
- Upsert anti-doublon dans le partage + trim email backend
- 12 tests tests/test_sharing.py ; suite 319 verte (+3 PDF pre-existants)

Sans oublier v5.4.0 (non publie jusque-la) :
- Undo/Redo (Ctrl+Z/Ctrl+Shift+Z/Ctrl+Y), duplicate (Ctrl+D), menu de bloc (turn
  into, couleurs, lien #fdblk-, move to, delete), drag&drop multi-selection,
  slash "Actions", en-tetes de tableau (has_header/first_col_header) + exports,
  sync realtime immédiat apres mutation ; 9 tests test_block_interactions.py

app/routers/sharing.py

@@ -61,16 +61,41 @@ async def share_page(page_id: int, request: Request):
             if not target:
                 raise HTTPException(404, "Target user not found")
 
-        cur = conn.execute(
-            """INSERT INTO page_shares (page_id, shared_with_user_id, shared_with_email, permission, created_by)
-               VALUES (?, ?, ?, ?, ?)""",
-            (page_id, target_user_id, email, permission, user["id"]),
-        )
+        # Upsert to avoid duplicates: update the existing permission if the same
+        # target (user or email) is already shared on this page.
+        target_row = None
+        if target_user_id:
+            target_row = conn.execute(
+                "SELECT id FROM page_shares WHERE page_id=? AND shared_with_user_id=?",
+                (page_id, target_user_id),
+            ).fetchone()
+        elif email:
+            target_row = conn.execute(
+                """SELECT id FROM page_shares
+                   WHERE page_id=? AND shared_with_email=? AND shared_with_user_id IS NULL""",
+                (page_id, email.strip()),
+            ).fetchone()
+
+        if target_row:
+            conn.execute(
+                "UPDATE page_shares SET permission=?, created_by=? WHERE id=?",
+                (permission, user["id"], target_row["id"]),
+            )
+            share_id = target_row["id"]
+        else:
+            if not email:
+                email = ""
+            cur = conn.execute(
+                """INSERT INTO page_shares (page_id, shared_with_user_id, shared_with_email, permission, created_by)
+                   VALUES (?, ?, ?, ?, ?)""",
+                (page_id, target_user_id, email.strip(), permission, user["id"]),
+            )
+            share_id = cur.lastrowid
         conn.execute("UPDATE pages SET is_shared=1 WHERE id=?", (page_id,))
         conn.commit()
 
     return {
-        "id": cur.lastrowid,
+        "id": share_id,
         "page_id": page_id,
         "shared_with_user_id": target_user_id,
         "shared_with_email": email,
@@ -79,6 +104,34 @@ async def share_page(page_id: int, request: Request):
     }
 
 
+@router.put("/pages/{page_id}/share/{share_id}", description="Update a share's permission.")
+async def update_share_permission(page_id: int, share_id: int, request: Request):
+    """Change the permission level of an existing share entry."""
+    _require_auth(request)
+
+    body = await request.json() if request.headers.get("content-type") else {}
+    permission = body.get("permission", "")
+
+    if permission not in ("view", "comment", "edit"):
+        raise HTTPException(400, "Invalid permission. Use view, comment, or edit.")
+
+    with get_conn() as conn:
+        row = conn.execute(
+            "SELECT id FROM page_shares WHERE id=? AND page_id=?",
+            (share_id, page_id),
+        ).fetchone()
+        if not row:
+            raise HTTPException(404, "Share entry not found")
+
+        conn.execute(
+            "UPDATE page_shares SET permission=? WHERE id=?",
+            (permission, share_id),
+        )
+        conn.commit()
+
+    return {"status": "updated", "share_id": share_id, "permission": permission}
+
+
 @router.delete("/pages/{page_id}/share/{share_id}")
 async def remove_share(page_id: int, share_id: int, request: Request):
     """Remove a share invitation."""