feat: collections, watchlists, and shareable links (v0.9.0)

Phase 3 completion — Personal Workflow feature set is now complete.

Collections / Watchlists:
- New tables: collections (UUID share_token, slug, public/private) and
  collection_bills (unique bill-per-collection constraint)
- Full CRUD API at /api/collections with bill add/remove endpoints
- Public share endpoint /api/collections/share/{token} (no auth)
- /collections list page with inline create form and delete
- /collections/[id] detail page: inline rename, public toggle,
  copy-share-link, bill search/add/remove
- CollectionPicker bookmark-icon popover on bill detail pages
- Collections nav link in sidebar (auth-required)

Shareable Brief Links:
- share_token UUID column on bill_briefs (backfilled on migration)
- Unified public share router at /api/share (brief + collection)
- /share/brief/[token] — minimal layout, full AIBriefCard, CTAs
- /share/collection/[token] — minimal layout, bill list, CTA
- Share2 button in BriefPanel header row, "Link copied!" flash

AuthGuard: /collections → AUTH_REQUIRED; /share prefix → NO_SHELL_PATHS

Authored-By: Jack Levy
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/alembic/versions/0015_add_collections.py

@@ -0,0 +1,52 @@
+"""Add collections and collection_bills tables
+
+Revision ID: 0015
+Revises: 0014
+"""
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+revision = "0015"
+down_revision = "0014"
+branch_labels = None
+depends_on = None
+
+
+def upgrade():
+    op.create_table(
+        "collections",
+        sa.Column("id", sa.Integer(), primary_key=True, autoincrement=True),
+        sa.Column("user_id", sa.Integer(), sa.ForeignKey("users.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("name", sa.String(100), nullable=False),
+        sa.Column("slug", sa.String(120), nullable=False),
+        sa.Column("is_public", sa.Boolean(), nullable=False, server_default="false"),
+        sa.Column(
+            "share_token",
+            postgresql.UUID(as_uuid=False),
+            nullable=False,
+            server_default=sa.text("gen_random_uuid()"),
+        ),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
+        sa.UniqueConstraint("share_token", name="uq_collections_share_token"),
+        sa.UniqueConstraint("user_id", "slug", name="uq_collections_user_slug"),
+    )
+    op.create_index("ix_collections_user_id", "collections", ["user_id"])
+    op.create_index("ix_collections_share_token", "collections", ["share_token"])
+
+    op.create_table(
+        "collection_bills",
+        sa.Column("id", sa.Integer(), primary_key=True, autoincrement=True),
+        sa.Column("collection_id", sa.Integer(), sa.ForeignKey("collections.id", ondelete="CASCADE"), nullable=False),
+        sa.Column("bill_id", sa.String(), sa.ForeignKey("bills.bill_id", ondelete="CASCADE"), nullable=False),
+        sa.Column("added_at", sa.DateTime(timezone=True), server_default=sa.func.now()),
+        sa.UniqueConstraint("collection_id", "bill_id", name="uq_collection_bills_collection_bill"),
+    )
+    op.create_index("ix_collection_bills_collection_id", "collection_bills", ["collection_id"])
+    op.create_index("ix_collection_bills_bill_id", "collection_bills", ["bill_id"])
+
+
+def downgrade():
+    op.drop_table("collection_bills")
+    op.drop_table("collections")