fix: security and UX improvements for notifications and shares

- Add ownership checks on all notification and share routes (403 Forbidden)
- Validate permission field (only view/edit/admin allowed)
- Remove user_id from POST notifications (only self-notifications)
- Add getNotification/getProjectShare to DB interface + adapter
- Add res.ok checks on all frontend API calls
- Add click-outside handler for notification dropdown
- Add initial notification load on mount for badge count
- Add email validation + duplicate check in ShareDialog
- Add Enter key handler in ShareDialog
- Add submitting state to prevent double-click
- Guard against null token in Dashboard

backend/src/database/SqliteAdapter.ts

@@ -272,6 +272,10 @@ export class SqliteAdapter implements DatabaseInterface {
     return this.db.prepare('SELECT * FROM notifications WHERE user_id = ? ORDER BY created_at DESC').all(userId) as DBNotification[];
   }
 
+  getNotification(id: string): DBNotification | null {
+    return this.db.prepare('SELECT * FROM notifications WHERE id = ?').get(id) as DBNotification | null;
+  }
+
   createNotification(data: Partial<DBNotification>): DBNotification {
     const id = data.id ?? `notif-${Date.now()}`;
     this.db.prepare(
@@ -293,6 +297,10 @@ export class SqliteAdapter implements DatabaseInterface {
     return this.db.prepare('SELECT * FROM project_shares WHERE project_id = ? ORDER BY created_at DESC').all(projectId) as DBProjectShare[];
   }
 
+  getProjectShare(id: string): DBProjectShare | null {
+    return this.db.prepare('SELECT * FROM project_shares WHERE id = ?').get(id) as DBProjectShare | null;
+  }
+
   createProjectShare(data: Partial<DBProjectShare>): DBProjectShare {
     const id = data.id ?? `share-${Date.now()}`;
     const shareToken = data.share_token ?? randomUUID();