plan: Phase 1 of worker pairing + sharing — pairing OTP + tier A end-to-end

Implementation plan for the smallest end-to-end useful slice of the
worker-sharing epic (#212). Friends-and-family GPU lending works at
the end of this phase: owner pairs a worker via OTP, creates a tier A
(inference-only) share with capability allowlist + concurrent-jobs
limit, hands the token to the recipient, recipient redeems and
appears in the recipient's Cluster app with a borrowed badge +
colour-coded border.

14 tasks split across worker (pairing module + endpoint + CLI + tray),
controller (SharesStore, ShareTokenSigner, /api/cluster/pair, share
CRUD, redeem, expiry watcher), and frontend (PairingDialog,
ShareDialog, RedeemDialog, BorrowedWorkerBadge, Activity SharesCard).
Each task is bite-sized TDD with concrete code in every step.

Riskiest pieces flagged for first scrutiny: ShareTokenSigner
(HMAC/replay), tier A enforcement gate (must not have bypass paths),
OTP single-use atomicity, bearer revocation latency.

Self-review pass complete: all Phase 1 spec items have a task,
deferred items documented, no placeholders, type-consistent across
tasks.

Author: jaylfc