Add multi-user auth, ownership, and experiment sharing

[lucastononro]

Gap. There is no user model anywhere — no users table in models.py, no user_id, no auth on any router; the whole instance is single-tenant with CORS open to all origins.

Value. Teams can't safely share an instance or attribute cost/experiments to people. This is the gate to Trainable being a team product rather than a solo tool.

Suggestion. Introduce authentication (see the API-auth issue), per-object ownership (Project/Experiment/RegisteredModel), and a share-by-link or team-visibility layer so cost dashboards and lineage become per-user.

[lucastononro]

Design note is up: docs/design/multi-user-auth.md (PR #167, doc-only). Summary of the proposed approach:

Data model. New users table (String-UUID PK + ISO timestamps, matching every existing table), plus auth_sessions (DB-backed browser sessions), api_tokens (per-user PATs, hashed), and project_shares. owner_id FKs land on Project, Experiment, RegisteredModel, Deployment — Project.owner_id is the single authoritative access root (children inherit through their project); experiment/model/deployment owner_id is creator attribution, which is what makes per-person cost/experiment views possible. usage_events gains a nullable user_id.

Auth. A mode ladder AUTH_MODE = none | token | multi_user. none is today, byte-for-byte; token is exactly PR #138's shared API_AUTH_TOKEN; multi_user adds real identity: HttpOnly session cookie for the browser (which also solves SSE — EventSource sends cookies automatically, so #138's ?token= carve-out remains only for PAT/CLI stream consumers, with optional short-lived stream tickets to fix the log-leak concern), per-user PATs on the same Authorization: Bearer wire shape for CLI/scripts, and OIDC SSO later minting the same session. In none/token modes get_current_user resolves to a fixed default owner user — so all ownership stamping/filtering code ships dark with zero behavior change. Cookie auth forces the CORS fix (["*"] + allow_credentials=True must become an origin allowlist in multi_user mode).

Migration. Three Alembic revisions on top of PR #153's chain: (1) additive tables + nullable owner_ids, (2) backfill every existing row to a well-known default-owner user (fixed UUID), (3) NOT NULL flip as its own revision. First real login "claims" the default owner's data. Historical usage_events stay unattributed rather than being falsely assigned.

Authorization. One rule: read iff you own the project / it's instance-visible / it's shared with you; write iff owner or can_write share; admins bypass; invisible objects 404 (existence is private), visible-but-not-writable 403. Implemented as a reusable get_accessible_project dependency + a scope_to_user query helper for list endpoints, with a per-router enforcement checklist (incl. scoping files/s3_browser, today's biggest exposure) and a route-matrix authz test to keep future routers honest.

Sharing. Project-granularity only in v1: visibility="instance" (team mode) + share-by-link / direct user grants via project_shares. Sub-project sharing is explicitly deferred (every adjacent surface traverses the project).

Frontend. One choke point (api.ts gains credentials + 401→/login redirect), a login page + me in context, owner badges + Share dialog in the gallery, per-user cost dashboard with an admin by_user breakdown; no SSE code changes for browsers.

Rollout. Phase 0: merge #153 + #138 (prerequisites) → Phase 1: silent schema + default owner (dark) → Phase 2: login + enforcement behind AUTH_MODE=multi_user → Phase 3: sharing + per-user views → Phase 4: SSO/admin/polish. Single-tenant open mode stays the default at every phase.

Key risks/open questions are in §10 of the doc — notably that can_write on a shared project is effectively "can execute code in its sandbox", and the CSRF posture for cookie auth.

Leaving this issue open to track the implementation phases; PR #167 is the design only.

[lucastononro]

Status after staging-v0.0.5: design doc is merged on the integration branch — docs/design/multi-user-auth.md (the branch link above is stale). No implementation yet: still no users table or owner_id in backend/models.py; the only auth shipped is the opt-in shared API_AUTH_TOKEN bearer gate (#88/#138), which the design keeps as AUTH_MODE=token. Implementation follows the doc's 4 phases (schema → identity → sharing → SSO). Absorbing from #82 (closed as subsumed): consider adding reverse-proxy header auth mode and per-project roles (owner/editor/viewer) as explicit follow-ups — both were requested there and are outside the current design.