feat(security): R4 S3 — abuse & leak hardening

- C-3.7: fold a per-link password_version into the signed watch grant (migration
  0059 adds the column) and bump it on every password change, so rotating a share
  link's password invalidates outstanding grants at once instead of letting them
  live out the 6h TTL. make_grant/check_grant take the version; update_link bumps.
- C-3.8: the share recipient picker and share-by-email now reuse the messageable
  filter (not-demo AND active AND not-suspended) instead of only excluding demo,
  so suspended/deactivated addresses aren't leaked or reachable as targets.
- C-3.9: GET /keys/{user_id} adopts get_thread's MB2 guard — a non-messageable
  target with no shared history returns the same "User not found" as a missing id,
  so it can't be probed to enumerate users or fetch suspended users' keys.
- C-3.12: _register_account catches IntegrityError on the insert (the select-then-
  insert TOCTOU) and treats it as the already-registered no-op.
- C-3.13: trigger_job claims the running flag atomically under _activity_lock
  (compare-and-set) instead of a bare check, closing the double-start window.
- Move _messageable/is_messageable_user into a shared app/userscope.py so downloads
  doesn't import the messages route module.

backend/app/routes/public.py

@@ -97,7 +97,7 @@ def watch_unlock(token: str, payload: dict, db: Session = Depends(get_db)) -> di
     job, asset = _ready_target(db, link)
     link.view_count += 1
     db.commit()
-    grant = linksmod.make_grant(token)
+    grant = linksmod.make_grant(token, link.password_version)
     return {
         "needs_password": False,
         **linksmod.public_meta(
@@ -111,7 +111,7 @@ def watch_file(token: str, g: str | None = None, db: Session = Depends(get_db)):
     """Range-aware stream of the shared file. Inline by default (plays in the page); an
     `allow_download` link serves it as an attachment. Password links require a valid grant."""
     link = _link_or_404(db, token)
-    if link.password_hash and not linksmod.check_grant(token, g):
+    if link.password_hash and not linksmod.check_grant(token, g, link.password_version):
         raise HTTPException(status_code=403, detail="This link needs a password.")
     asset = _ready_asset(db, link)
     path = storage.safe_abs_path(settings.download_root, asset.rel_path)
@@ -129,7 +129,7 @@ def watch_poster(token: str, g: str | None = None, db: Session = Depends(get_db)
     """The generated poster frame for a shared thumbnail-less video (used as the page/video poster
     and the link-preview image). Password links require a valid grant, like the file."""
     link = _link_or_404(db, token)
-    if link.password_hash and not linksmod.check_grant(token, g):
+    if link.password_hash and not linksmod.check_grant(token, g, link.password_version):
         raise HTTPException(status_code=403, detail="This link needs a password.")
     job, asset = _ready_target(db, link)
     if not asset.poster_path: