Granular data sharing: decisions, project info, and other namespaces #37

Background

Issue #36 (labeled API tokens) establishes non-local access scoped to RAG
data. This issue tracks the follow-on: letting users share other categories
of data with remote clients or other users.

Proposed data namespaces

Token scope field

Extend user_tokens from issue #36 with a scope column:

ALTER TABLE user_tokens ADD COLUMN scope TEXT NOT NULL DEFAULT 'rag';

Scope is a comma-separated list of allowed namespaces, e.g. "rag,decisions".
The auth middleware enforces scope on each endpoint.

CLI

ragger token create <label> --scope rag,decisions

Questions to resolve

• Should scope be checked at the HTTP layer or the storage layer?
• Should decisions and projects be separate SQLite tables or collections within the existing memories table?
• Should a user be able to grant another user read-only vs read-write access per namespace?
• Are there any namespaces that should never be shareable (e.g. raw chat logs)?

Depends on

Issue #36 — labeled API tokens must land first.