[littlegrasscao]

Summary

• add ShareEntity persistence with Hibernate (JpaTransactions) and the provider share API under provider.base-path (default /api/1.0/opensharing/provider), served by ShareAdminService on Armeria:
  • POST /shares, GET /shares, GET /shares/{share}, PATCH /shares/{share}, DELETE /shares/{share}
• ProviderTokenDecorator authenticates every provider request by calling CatalogConnector.authorize with the bearer token and no privilege. A missing token, or one the catalog cannot authenticate, is 401 UNAUTHENTICATED
• ShareService.create calls catalog.authorize(CREATE_SHARE); the catalog's userId becomes the share owner, and only the owner may update or delete the share; Ownership.check denies a missing owner or user id
• owner changes to a share load it with SELECT ... FOR UPDATE, so concurrent changes to one share run one at a time and each sees what the one before it wrote; an update that waits on a delete gets 404
• the local catalog file lists the principals it accepts; OpenSharing keeps no principal table
• shared objects and recipient grants are not in this PR

Testing

• mvn clean install: 82 tests passed
• ShareServiceTest: creating a share requires CREATE_SHARE from the catalog
• OwnershipTest: only the owner passes the owner check, and a missing owner or user id never matches
• ProviderTokenDecoratorTest: a missing token never reaches the catalog, a token the catalog cannot authenticate is 401, other catalog failures are 502, and the authenticated caller reaches the service
• ShareAdminServiceTest: share CRUD over HTTP, duplicate and invalid names, partial updates, owner-only deletes, and 404 for missing shares