feat(share,permissions): partage de page par groupes (page_shares)

- app/db.py: ajout colonne shared_with_group_id (FK user_groups, migration
  backfill v5.x) dans page_shares
- app/routers/sharing.py: POST /api/pages/{id}/share accepte group_id
  (upsert, verif FK groupe), GET /shares expose kind/group_name, synchro
  bidirectionnelle avec page_permissions (mirror grant/revoke) pour que
  PermissionManager donne un acces effectif (view/comment/edit) aux membres
  du groupe; PUT/DELETE gardent le miroir a jour
- app/routers/board.py, library.py: received/made incluent les partages via
  groupes (JOIN group_members)
- app/templates/_page_editor_content.html, _page_editor_scripts.html:
  dialogue Share — invite groups (fetch /api/v2/groups, filtre deja partages),
  pickInviteGroup, shareInvite(group_id), rendu accessList avec avatar groupe
- tests/test_share_groups.py: 10 tests (CRUD groupe, kind, miroir ACL)

Chore: inclut evolutions v6.4.0 deja en working copy (webhooks prod,
migrations, sync, config/main) pour garder l'arbre coherent.

app/routers/sync.py

@@ -1,16 +1,18 @@
-"""FlowDeck — /api/v2/sync endpoints (v6.0.0 PWA offline sync).
+"""FlowDeck — /api/v2/sync endpoints (v6.0.0 PWA offline sync, Bearer v6.4.0).
 
-Pairs with ``app/services/sync_engine.py``. All routes require an authenticated
-session (``flowdeck_session`` cookie).
+Auth: ``Authorization: Bearer <token>`` (scopes ``read`` for delta/status,
+``write`` for batch). The legacy ``flowdeck_session`` cookie is still accepted
+as a fallback so the installed PWA/service worker keeps syncing.
 """
 from __future__ import annotations
 
 import logging
 
-from fastapi import APIRouter, HTTPException, Query, Request
+from fastapi import APIRouter, Header, HTTPException, Query, Request
 from fastapi.responses import JSONResponse
 
 from app.auth.session import SessionManager
+from app.services.api_v2_helpers import get_bearer_user, has_scope
 from app.services.sync_engine import SyncEngine
 
 logger = logging.getLogger(__name__)
@@ -20,7 +22,21 @@ router = APIRouter(prefix="/api/v2/sync", tags=["sync"])
 _engine = SyncEngine()
 
 
-def _user(request: Request) -> dict:
+def _user(request: Request, authorization: str | None = None,
+          *, required_scope: str = "read") -> dict:
+    """Bearer-first auth with session-cookie fallback (offline.js compat)."""
+    auth = authorization or request.headers.get("authorization") or ""
+    if auth and auth.lower().startswith("bearer "):
+        try:
+            user = get_bearer_user(request, authorization)
+        except HTTPException:
+            raise HTTPException(status_code=401, detail="Invalid or expired API token")
+        if not has_scope(user.get("_token_scopes"), required_scope):
+            raise HTTPException(
+                status_code=403,
+                detail=f"Insufficient scope. Required: {required_scope}",
+            )
+        return user
     user = SessionManager.decode_session(request.cookies.get("flowdeck_session", ""))
     if not user:
         raise HTTPException(status_code=401, detail="Authentication required")
@@ -32,9 +48,10 @@ async def sync_delta(
     request: Request,
     since: float = Query(default=0, description="Epoch seconds (ou ms) du dernier sync"),
     workspace_id: int = Query(default=None),
+    authorization: str | None = Header(default=None),
 ):
     """Pull server-side changes since `since` (for the given workspace)."""
-    user = _user(request)
+    user = _user(request, authorization, required_scope="read")
     if workspace_id is None:
         raise HTTPException(status_code=400, detail="workspace_id is required")
     result = await _engine.get_delta(user["id"], since, workspace_id)
@@ -44,9 +61,9 @@ async def sync_delta(
 
 
 @router.post("/batch")
-async def sync_batch(request: Request):
+async def sync_batch(request: Request, authorization: str | None = Header(default=None)):
     """Apply a batch of offline mutations and return per-mutation results."""
-    user = _user(request)
+    user = _user(request, authorization, required_scope="write")
     try:
         body = await request.json()
     except Exception:
@@ -63,9 +80,10 @@ async def sync_batch(request: Request):
 
 
 @router.get("/status")
-async def sync_status(request: Request, workspace_id: int = Query(default=None)):
+async def sync_status(request: Request, workspace_id: int = Query(default=None),
+                      authorization: str | None = Header(default=None)):
     """Synchronization status for the workspace (pending server queue, last sync)."""
-    user = _user(request)
+    user = _user(request, authorization, required_scope="read")
     from app.db import get_conn
     with get_conn() as conn:
         if not SyncEngine._can_access(conn, user["id"], workspace_id):