feat(security): R4 S3 — abuse & leak hardening

- C-3.7: fold a per-link password_version into the signed watch grant (migration
  0059 adds the column) and bump it on every password change, so rotating a share
  link's password invalidates outstanding grants at once instead of letting them
  live out the 6h TTL. make_grant/check_grant take the version; update_link bumps.
- C-3.8: the share recipient picker and share-by-email now reuse the messageable
  filter (not-demo AND active AND not-suspended) instead of only excluding demo,
  so suspended/deactivated addresses aren't leaked or reachable as targets.
- C-3.9: GET /keys/{user_id} adopts get_thread's MB2 guard — a non-messageable
  target with no shared history returns the same "User not found" as a missing id,
  so it can't be probed to enumerate users or fetch suspended users' keys.
- C-3.12: _register_account catches IntegrityError on the insert (the select-then-
  insert TOCTOU) and treats it as the already-registered no-op.
- C-3.13: trigger_job claims the running flag atomically under _activity_lock
  (compare-and-set) instead of a bare check, closing the double-start window.
- Move _messageable/is_messageable_user into a shared app/userscope.py so downloads
  doesn't import the messages route module.

backend/alembic/versions/0059_dl_link_pw_version.py

@@ -0,0 +1,32 @@
+"""add password_version to download_links (invalidate watch grants on password change)
+
+Revision ID: 0059_dl_link_pw_version
+Revises: 0058_dl_default_720p
+Create Date: 2026-07-23
+
+A password-protected share link mints a short-lived HMAC "grant" at /unlock so the media URL never
+carries the password. The grant previously signed only <token>.<exp>, so rotating a link's password
+did NOT invalidate outstanding grants — they lived out their 6h TTL. Fold a per-link password_version
+into the signed grant and bump it on every password change, so a rotation revokes old grants at once.
+Small table (one row per share link), so this is a quick add-column with a default.
+"""
+from typing import Sequence, Union
+
+import sqlalchemy as sa
+from alembic import op
+
+revision: str = "0059_dl_link_pw_version"
+down_revision: Union[str, None] = "0058_dl_default_720p"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "download_links",
+        sa.Column("password_version", sa.Integer(), nullable=False, server_default="0"),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("download_links", "password_version")