relay: surface shared-bucket activity in compose sidebar

Relay UI already shows a tenant's inbox + sent mails. Add a parallel
view for collaborative bucket cards the logged-in tenant is a member
of, so activity on shared boards is visible without needing the hyprcrd
client open.

New `GET /api/collab-inbox` endpoint (session-auth only) decrypts
payloads with the inter-tenant key and returns title + preview + author
+ bucket metadata. UI restructures the compose view into editor + right
sidebar stacking inbox → shared → sent, and polls all three on the
existing 15s tick.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

relay/inc/routes/collab-cards.php

@@ -105,6 +105,47 @@ if ($route === '/api/collab-cards' && $method === 'POST') {
 
 // ── GET: pull deltas since a given timestamp ─────────────────────
 
+// ── Session-auth summary for the relay UI ─────────────────────
+// Lets the relay's web UI surface collab bucket activity to the
+// logged-in tenant without exposing the per-client encryption dance:
+// decrypts payloads with the inter-tenant key (we're authorizing via
+// the PHP session, so there's no per-request client secret). Returns
+// just title + small body preview + author + bucket so the UI can list
+// recent activity like an inbox.
+if ($route === '/api/collab-inbox' && $method === 'GET' && $sessionTenant) {
+    $interKey = getInterTenantKey($db, $MASTER_KEY);
+    if (!$interKey) jsonResponse(['error' => 'relay super-shared key not set'], 500);
+    $stmt = $db->prepare('
+        SELECT c.bucket_uid, c.card_uid, c.author_username, c.payload, c.updated_at, c.deleted,
+               b.name AS bucket_name, b.color AS bucket_color
+        FROM collab_cards c
+        INNER JOIN collab_bucket_members m ON m.bucket_uid = c.bucket_uid
+        LEFT JOIN collab_buckets b ON b.uid = c.bucket_uid
+        WHERE m.tenant_id = :tid AND c.deleted = 0
+        ORDER BY c.updated_at DESC
+        LIMIT 200
+    ');
+    $stmt->execute(['tid' => $sessionTenant['id']]);
+    $out = [];
+    foreach ($stmt->fetchAll() as $row) {
+        $plain = clientDecrypt($row['payload'] ?? '', $interKey);
+        $fields = $plain ? (json_decode($plain, true) ?: []) : [];
+        $body = (string)($fields['body'] ?? '');
+        $out[] = [
+            'bucket_uid'      => $row['bucket_uid'],
+            'bucket_name'     => $row['bucket_name'],
+            'bucket_color'    => $row['bucket_color'] ?? '#38bdf8',
+            'card_uid'        => $row['card_uid'],
+            'author_username' => $row['author_username'],
+            'title'           => (string)($fields['title'] ?? ''),
+            'preview'         => mb_substr(trim(strip_tags($body)), 0, 140),
+            'updated_at'      => $row['updated_at'],
+            'mine'            => $row['author_username'] === $sessionTenant['username'],
+        ];
+    }
+    jsonResponse(['ok' => true, 'items' => $out]);
+}
+
 if ($route === '/api/collab-cards' && $method === 'GET') {
     if (!$clientTenant) jsonResponse(['error' => 'unauthorized'], 401);
     if (isRateLimited($db, 'collab-cards-get', 120)) jsonResponse(['error' => 'rate limited'], 429);