feat(sprint-4/etapa-5): modelo de privacidad RLS granular + UI de visibilidad

- SQL 010: tablas user_groups y group_memberships con RLS
- SQL 011: tabla process_access para acceso explícito a procesos
- SQL 012: función is_platform_admin() + políticas granulares (select/insert/update/delete) en processes
- types.ts: Process.ownerId (requerido)
- process-repo: fromRow mapea owner_id→ownerId; toRow preserva ownerId en updates; setShared() no-op documentado
- ImportPage: asigna ownerId: user.id al crear proceso
- LibraryPage: toggle Todos/Míos, OwnershipBadge (🔒/👤) en cada tarjeta, opción "Compartir con equipo" en menú de proceso propio con toast de confirmación
- Tests: ownerId: 'test-user' agregado a todos los fixtures de Process

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

supabase/migrations/011_create_process_access.sql

@@ -0,0 +1,21 @@
+CREATE TABLE IF NOT EXISTS public.process_access (
+  process_id    uuid  NOT NULL REFERENCES public.processes(id) ON DELETE CASCADE,
+  grantee_type  text  NOT NULL CHECK (grantee_type IN ('user','group')),
+  grantee_id    uuid  NOT NULL,
+  permission    text  NOT NULL DEFAULT 'view' CHECK (permission IN ('view','edit')),
+  PRIMARY KEY (process_id, grantee_type, grantee_id)
+);
+
+ALTER TABLE public.process_access ENABLE ROW LEVEL SECURITY;
+
+CREATE POLICY "read_process_access" ON public.process_access
+  FOR SELECT USING (auth.uid() IS NOT NULL);
+
+CREATE POLICY "manage_process_access" ON public.process_access
+  FOR ALL USING (
+    EXISTS (SELECT 1 FROM public.users WHERE id = auth.uid() AND platform_role = 'platform_admin')
+    OR EXISTS (
+      SELECT 1 FROM public.processes
+      WHERE id = process_access.process_id AND owner_id = auth.uid()
+    )
+  );