plugin(collab-buckets): collaborative buckets via relay

End-to-end shared buckets between relay tenants. Bucket metadata + members
sync through new relay routes (collab-buckets, collab-cards, collab-locks);
card content rides the existing inter-tenant encryption hop. Edit locks,
ownership transfer, LWW conflict stashing, undo for local-bucket destructive
actions, "Make collaborative…" upgrade path, and a resilient outbox for
relay-down create attempts. See plugins/collab-buckets/README.md and
TODO.md for the full picture.

Core hooks added so the plugin can integrate without monkey-patching:
- buckets.js context menu: collab-aware rename/color/delete + Members &
  owner / Make collaborative entries
- editor.js dispatches hyprcrd:editor-open / hyprcrd:editor-close for the
  per-card edit-lock heartbeat
- app.js exposes window.state for the plugin's MutationObserver
- index.php POST/PATCH/DELETE on /api/buckets refuse to mutate collab
  buckets directly (must go through the relay)
- Database.php adds buckets.collab_uid column + unique partial index
- import handler now restores color and collab_uid (was silently dropping
  color, which caused the test runner's auto-restore to wipe custom
  bucket colors)
- relay bootstrap creates collab_buckets, collab_bucket_members,
  collab_cards, collab_card_locks tables and prunes tombstones / expired
  locks on every request

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

relay/inc/bootstrap.php

@@ -181,6 +181,64 @@ $db->exec('CREATE TABLE IF NOT EXISTS chat_messages (
 )');
 $db->exec('CREATE INDEX IF NOT EXISTS idx_chat_recipient ON chat_messages(recipient_id, fetched, id)');
 
+// Collaborative buckets: shared among multiple tenants. Each bucket has one
+// owner and a membership set. Buckets persist (not ephemeral) since they are
+// the container for ongoing collaboration — cleanup only when deleted.
+$db->exec('CREATE TABLE IF NOT EXISTS collab_buckets (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    uid TEXT UNIQUE NOT NULL,
+    owner_id INTEGER NOT NULL,
+    owner_username TEXT NOT NULL,
+    name TEXT NOT NULL,
+    color TEXT NOT NULL DEFAULT "#38bdf8",
+    created_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    FOREIGN KEY (owner_id) REFERENCES tenants(id) ON DELETE CASCADE
+)');
+$db->exec('CREATE TABLE IF NOT EXISTS collab_bucket_members (
+    bucket_uid TEXT NOT NULL,
+    tenant_id INTEGER NOT NULL,
+    username TEXT NOT NULL,
+    added_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    PRIMARY KEY (bucket_uid, tenant_id),
+    FOREIGN KEY (tenant_id) REFERENCES tenants(id) ON DELETE CASCADE
+)');
+$db->exec('CREATE INDEX IF NOT EXISTS idx_collab_member_tenant ON collab_bucket_members(tenant_id, bucket_uid)');
+$db->exec('CREATE INDEX IF NOT EXISTS idx_collab_bucket_updated ON collab_buckets(updated_at)');
+
+// Collab cards: the actual synced content, stored at-rest under the
+// inter-tenant key. Payload is an encrypted JSON blob containing title,
+// body, color, tags, due_date, position. Tombstoned rows (deleted=1)
+// survive for 7 days so late pollers see the deletion.
+$db->exec('CREATE TABLE IF NOT EXISTS collab_cards (
+    id INTEGER PRIMARY KEY AUTOINCREMENT,
+    bucket_uid TEXT NOT NULL,
+    card_uid TEXT NOT NULL,
+    author_username TEXT NOT NULL,
+    payload TEXT NOT NULL,
+    updated_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    deleted INTEGER NOT NULL DEFAULT 0,
+    UNIQUE (bucket_uid, card_uid)
+)');
+$db->exec('CREATE INDEX IF NOT EXISTS idx_collab_cards_bucket_updated ON collab_cards(bucket_uid, updated_at)');
+
+// Phase 4: advisory edit locks on collab cards. A client that opens the
+// editor for a collab card heartbeats into this table every 30s with a
+// 60s TTL. Other clients poll the list and show a lock indicator on the
+// card. The lock is purely advisory — force-editing is still allowed and
+// LWW remains the authoritative conflict resolver.
+$db->exec('CREATE TABLE IF NOT EXISTS collab_card_locks (
+    bucket_uid TEXT NOT NULL,
+    card_uid TEXT NOT NULL,
+    holder_id INTEGER NOT NULL,
+    holder_username TEXT NOT NULL,
+    acquired_at TEXT NOT NULL DEFAULT CURRENT_TIMESTAMP,
+    expires_at TEXT NOT NULL,
+    PRIMARY KEY (bucket_uid, card_uid, holder_id),
+    FOREIGN KEY (holder_id) REFERENCES tenants(id) ON DELETE CASCADE
+)');
+$db->exec('CREATE INDEX IF NOT EXISTS idx_collab_card_locks_expires ON collab_card_locks(expires_at)');
+
 $db->exec('CREATE TABLE IF NOT EXISTS sessions (
     id TEXT PRIMARY KEY,
     tenant_id INTEGER NOT NULL,
@@ -200,6 +258,10 @@ $db->exec("DELETE FROM messages WHERE created_at < datetime('now', '-24 hours')"
 $db->exec("DELETE FROM attachments WHERE created_at < datetime('now', '-24 hours')");
 // Chat: 7 days, longer than card sync but still ephemeral
 $db->exec("DELETE FROM chat_messages WHERE created_at < datetime('now', '-7 days')");
+// Collab-card tombstones: 7 days so late pollers still see the delete.
+$db->exec("DELETE FROM collab_cards WHERE deleted = 1 AND updated_at < datetime('now', '-7 days')");
+// Collab-card locks: drop everything past its TTL on every request.
+$db->exec("DELETE FROM collab_card_locks WHERE expires_at < datetime('now')");
 $db->exec("DELETE FROM sessions WHERE expires_at < datetime('now')");
 $db->exec("DELETE FROM rate_limits WHERE attempted_at < datetime('now', '-5 minutes')");