feat(share): a link's address says what it opens

A video stays on /watch/, anything else is given out on /file/ and a folder on /folder/. The token
is the whole key, so every path opens every link and the links already sent keep working. The new
paths are kept out of search indexes like /watch/, boot the player alone, and the unfurl card calls a
file a file.

frontend/src/lib/api/downloads.ts

@@ -145,7 +145,7 @@ export interface ShareLink {
   // Null when the server cannot show this link's address again (no encrypted copy its key reads): the
   // link still opens for whoever has it; to share it anew, make a new link.
   token: string | null;
-  url: string | null; // path like "/watch/<token>" — prepend window.location.origin to share
+  url: string | null; // path like "/watch/<token>" or "/file/<token>" — prepend window.location.origin to share
   allow_download: boolean;
   has_password: boolean;
   expires_at: string | null;

frontend/src/watch/WatchPage.dom.test.tsx

@@ -24,6 +24,20 @@ afterEach(() => {
   localStorage.clear();
 });
 
+describe("WatchPage share paths", () => {
+  it.each(["/watch/tok-p", "/file/tok-p", "/folder/tok-p", "/file/tok-p/extra"])(
+    "reads the token off %s",
+    async (path) => {
+      window.history.replaceState({}, "", path);
+      mockMeta({ needs_password: false, audio: false, file_url: "/f.mp4", title: "A clip" });
+      render(<WatchPage />);
+      await waitFor(() =>
+        expect(fetch).toHaveBeenCalledWith("/api/public/watch/tok-p", expect.anything()),
+      );
+    },
+  );
+});
+
 describe("WatchPage background play", () => {
   it("hands its <video> to the background-play hook, so Brave iOS keeps it playing", async () => {
     window.history.replaceState({}, "", "/watch/tok-bg");

frontend/src/watch/WatchPage.tsx

@@ -28,7 +28,7 @@ import { SURFACE } from "../components/ui/surfaces";
 import { IconLink, LinkButton } from "../components/ui/LinkButton";
 import { T, lang } from "./watchStrings";
 
-// Standalone, login-free page for a shared /watch/<token> link: one file, or a folder's list of them.
+// Standalone, login-free page for a share link (/watch/, /file/, /folder/): one file, or a folder's list.
 // Its own entry (watchMain.tsx, watch.html): no auth, no providers, none of the app's bundle. Uses
 // plain fetch and a tiny self-contained i18n dict (`watchStrings`: the public viewer has no app
 // language preference).
@@ -83,8 +83,14 @@ async function notFoundState(r: Response): Promise<"preparing" | "gone"> {
   return body?.detail?.reason === "video_preparing" ? "preparing" : "gone";
 }
 
+/** The token of a share path: /watch/ for a video, /file/ or /folder/ for the rest, any of them for
+ * any link (`main.SHARE_PREFIXES`). */
+function shareToken(path: string): string {
+  return /^\/(?:watch|file|folder)\/([^/?#]+)/.exec(path)?.[1] ?? "";
+}
+
 export default function WatchPage() {
-  const token = window.location.pathname.split("/watch/")[1]?.split(/[/?#]/)[0] ?? "";
+  const token = shareToken(window.location.pathname);
   // Seeded from the URL rather than corrected by the effect below: with no token there is nothing
   // to load, and "loading" was committed and painted before the effect said so.
   const [status, setStatus] = useState<

frontend/src/watchEntry.contract.test.ts

@@ -99,6 +99,29 @@ function chain(seen: Map<string, string | null>, mod: string): string {
   return path.join(" → ");
 }
 
+describe("the paths a share link opens on", () => {
+  // The server's list: each of the places below that has to know them follows it.
+  const main = readFileSync(join(SRC, "..", "..", "backend", "app", "main.py"), "utf8");
+  const prefixes = [
+    ...(/SHARE_PREFIXES = \(([^)]*)\)/.exec(main)?.[1] ?? "").matchAll(/"(\w+)\/"/g),
+  ].map((m) => m[1]);
+
+  it("are read off the server", () => {
+    expect(prefixes).toEqual(["watch", "file", "folder"]);
+  });
+
+  it("are all kept out of search indexes", () => {
+    const robots = readFileSync(join(SRC, "..", "public", "robots.txt"), "utf8");
+    for (const p of prefixes) expect(robots).toContain(`Disallow: /${p}/`);
+  });
+
+  it("all boot the player alone in `vite dev` and all give up their token", () => {
+    const vite = readFileSync(join(SRC, "..", "vite.config.ts"), "utf8");
+    const page = readFileSync(join(SRC, "watch", "WatchPage.tsx"), "utf8");
+    for (const src of [vite, page]) expect(src).toContain(`(?:${prefixes.join("|")})`);
+  });
+});
+
 describe("the /watch entry", () => {
   it("loads nothing the app alone may load", () => {
     const seen = reach(join(SRC, "watchMain.tsx"));