Feature: Add shared workspaces with invitations, roles, and task assignment

## Summary

Enable multiple users to collaborate in shared workspaces with controlled membership, task assignment, and realtime updates.

## Problem / Opportunity

Current task ownership is personal and RLS is centered on a single user. TaskNexus cannot support household lists, study groups, or small teams without sharing credentials or copying tasks, both of which break accountability and data safety.

## Proposed Feature

Introduce shared workspaces with an invitation lifecycle and explicit owner, editor, and viewer permissions. Tasks can belong to a personal area or workspace and can be assigned to eligible members. Realtime changes should preserve author and assignment context.

## Scope

- Add workspace, membership, invitation, and task-assignment data models.
- Replace ownership-only authorization assumptions with tested workspace-aware RLS policies.
- Build invite acceptance/decline, member management, role changes, leave, and ownership-transfer flows.
- Add workspace switching and assignment controls to task UI.
- Display who changed or owns relevant work where useful without exposing private account data.
- Document the permission matrix and security model.

## Acceptance Criteria

- [ ] Users can create a workspace and invite another account through a time-bounded, single-use flow.
- [ ] Owners can manage roles; editors and viewers receive only documented capabilities.
- [ ] Users can switch between personal tasks and each workspace they belong to.
- [ ] Eligible members can be assigned/unassigned according to role rules.
- [ ] RLS tests demonstrate that non-members and removed members cannot read or mutate workspace data.
- [ ] Realtime task and membership changes propagate without leaking data after access is revoked.
- [ ] Leaving, removing a member, and transferring ownership have explicit safeguards and tested outcomes.
- [ ] Empty, expired-invite, revoked-access, and concurrent-membership-change states have actionable UI.
- [ ] Collaboration controls are keyboard and screen-reader accessible on supported platforms.
- [ ] Contributor documentation includes schema, permission matrix, invite lifecycle, and local test setup.

## Non-Goals

- Public workspaces or anonymous links.
- Enterprise SSO, billing, or large-organization administration.
- Chat, video calls, or document collaboration.

## Dependencies / Risks

- This is a security-sensitive RLS redesign; authorization must be enforced server-side, not only in UI.
- Subscription cleanup is critical when users switch workspaces or lose access.
- Email delivery or deep linking may be needed for invitations.

## Open Questions

- Can editors invite members, or only owners?
- Should tasks support multiple assignees?
- What happens to a user's assigned tasks when that member leaves?