feat(security): R4 S3 — abuse & leak hardening

- C-3.7: fold a per-link password_version into the signed watch grant (migration
  0059 adds the column) and bump it on every password change, so rotating a share
  link's password invalidates outstanding grants at once instead of letting them
  live out the 6h TTL. make_grant/check_grant take the version; update_link bumps.
- C-3.8: the share recipient picker and share-by-email now reuse the messageable
  filter (not-demo AND active AND not-suspended) instead of only excluding demo,
  so suspended/deactivated addresses aren't leaked or reachable as targets.
- C-3.9: GET /keys/{user_id} adopts get_thread's MB2 guard — a non-messageable
  target with no shared history returns the same "User not found" as a missing id,
  so it can't be probed to enumerate users or fetch suspended users' keys.
- C-3.12: _register_account catches IntegrityError on the insert (the select-then-
  insert TOCTOU) and treats it as the already-registered no-op.
- C-3.13: trigger_job claims the running flag atomically under _activity_lock
  (compare-and-set) instead of a bare check, closing the double-start window.
- Move _messageable/is_messageable_user into a shared app/userscope.py so downloads
  doesn't import the messages route module.

backend/app/downloads/links.py

@@ -33,13 +33,17 @@ def _sign(msg: str) -> str:
     ).hexdigest()[:32]
 
 
-def make_grant(token: str, now: float | None = None) -> str:
-    """A short-lived HMAC grant proving the viewer unlocked `token`. Format: `<exp>.<sig>`."""
+def make_grant(token: str, password_version: int, now: float | None = None) -> str:
+    """A short-lived HMAC grant proving the viewer unlocked `token`. Format: `<exp>.<sig>`. The
+    link's current `password_version` is folded into the signature, so rotating the password (which
+    bumps the version) invalidates every grant minted under the old password at once."""
     exp = int((now if now is not None else datetime.now(timezone.utc).timestamp())) + _GRANT_TTL
-    return f"{exp}.{_sign(f'{token}.{exp}')}"
+    return f"{exp}.{_sign(f'{token}.{exp}.{password_version}')}"
 
 
-def check_grant(token: str, grant: str | None) -> bool:
+def check_grant(token: str, grant: str | None, password_version: int) -> bool:
+    """Verify a grant against the link's CURRENT `password_version`; a version bump (password
+    rotation) fails the signature check even before the grant's TTL expires."""
     if not grant or "." not in grant:
         return False
     exp_s, sig = grant.split(".", 1)
@@ -49,7 +53,7 @@ def check_grant(token: str, grant: str | None) -> bool:
         return False
     if exp < datetime.now(timezone.utc).timestamp():
         return False
-    return hmac.compare_digest(sig, _sign(f"{token}.{exp}"))
+    return hmac.compare_digest(sig, _sign(f"{token}.{exp}.{password_version}"))
 
 
 # --- serialization -------------------------------------------------------------------------