Share several of a client's projects at once and show sharing in the list

[str1fe]

Why

Follow-up to #463. Sharing one project at a time is tedious when a client has several, the invitation email didn't say which client the project belongs to, and the owner couldn't see what was shared without opening each project.

What changes

1. Email names the client and the organization. Subject: "Company Inc has shared E Corp CRM (E Corp) with you", or "Company Inc has shared 2 projects for E Corp with you" when several go together. The body names the inviting user, their organization and the client, and lists the projects.
2. Share several projects per client. Each client card on Clients & projects has a new share button. It opens a modal with an email field and a checkbox per project (all checked, with "Select all"). Projects that are already shared show who they're shared with. One email goes out. If any project can't be shared (e.g. that address is already invited to it), nothing is created and the modal says which project the problem is on. The per-project Sharing tab is unchanged.
3. Sharing visible in the list. Each project row shows a green "Shared with Acme AS" badge for accepted shares, or a grey "Invitation sent" badge while waiting. The badge links to the project's Sharing tab.

Answering invitations together

Open invitations from one organization to one address are answered together: whichever link the recipient opens, the invitation page lists all of them, and Accept/Decline applies to all (ProjectShare#open_invitations_alongside). This needed no schema change. It also covers invitations sent separately, and ones sent before this change. When accepting, projects the chosen organization already has are left alone and the rest are accepted.

Compatibility

No migration. Existing invitation links and tokens work as before. The mailer now takes project_shares: instead of project_share:, so a share email sitting in the Sidekiq queue during the deploy would fail. We accepted that risk since the window is only seconds.

Authorization

Workspace::Clients::SharesController loads the client through authorized_scope, authorizes share? on Workspace::ClientPolicy (admins of the owning organization) and authorizes each new share with Workspace::ProjectSharePolicy. Only projects of that client can be selected, so other organizations' projects are ignored.

Test plan

• bin/rails test: 408 runs, 0 failures (new integration tests cover sharing several projects, validation, cross-org attempts, accepting/declining together, skipping projects the organization already has, and the list badges; mailer tests cover the single and multi-project email)
• bin/rails test:system: 9 runs, 0 failures (new client_sharing_test.rb walks through the modal)
• bin/rubocop: no offenses
• Checked the modal, list badges, invitation page and email in nb and en via screenshots

🤖 Generated with Claude Code