feat(security): R4 S3 — abuse & leak hardening

- C-3.7: fold a per-link password_version into the signed watch grant (migration
  0059 adds the column) and bump it on every password change, so rotating a share
  link's password invalidates outstanding grants at once instead of letting them
  live out the 6h TTL. make_grant/check_grant take the version; update_link bumps.
- C-3.8: the share recipient picker and share-by-email now reuse the messageable
  filter (not-demo AND active AND not-suspended) instead of only excluding demo,
  so suspended/deactivated addresses aren't leaked or reachable as targets.
- C-3.9: GET /keys/{user_id} adopts get_thread's MB2 guard — a non-messageable
  target with no shared history returns the same "User not found" as a missing id,
  so it can't be probed to enumerate users or fetch suspended users' keys.
- C-3.12: _register_account catches IntegrityError on the insert (the select-then-
  insert TOCTOU) and treats it as the already-registered no-op.
- C-3.13: trigger_job claims the running flag atomically under _activity_lock
  (compare-and-set) instead of a bare check, closing the double-start window.
- Move _messageable/is_messageable_user into a shared app/userscope.py so downloads
  doesn't import the messages route module.

backend/tests/test_links.py

@@ -14,30 +14,37 @@ def test_new_token_is_unguessable_and_unique():
 
 class TestGrant:
     def test_a_fresh_grant_verifies_for_its_own_token(self):
-        grant = make_grant("tok")
-        assert check_grant("tok", grant) is True
+        grant = make_grant("tok", 0)
+        assert check_grant("tok", grant, 0) is True
 
     def test_a_grant_does_not_verify_for_a_different_token(self):
         # The signature binds the token, so a grant minted for one link can't unlock another.
-        assert check_grant("other", make_grant("tok")) is False
+        assert check_grant("other", make_grant("tok", 0), 0) is False
 
     def test_a_tampered_signature_is_rejected(self):
-        exp, _sig = make_grant("tok").split(".", 1)
-        assert check_grant("tok", f"{exp}.deadbeef") is False
+        exp, _sig = make_grant("tok", 0).split(".", 1)
+        assert check_grant("tok", f"{exp}.deadbeef", 0) is False
 
     def test_a_tampered_expiry_is_rejected(self):
-        # Extending the exp field invalidates the signature (which covers token.exp).
-        _exp, sig = make_grant("tok").split(".", 1)
+        # Extending the exp field invalidates the signature (which covers token.exp.version).
+        _exp, sig = make_grant("tok", 0).split(".", 1)
         future = int(datetime.now(timezone.utc).timestamp()) + 10 * _GRANT_TTL
-        assert check_grant("tok", f"{future}.{sig}") is False
+        assert check_grant("tok", f"{future}.{sig}", 0) is False
 
     def test_an_expired_grant_is_rejected(self):
         past = datetime.now(timezone.utc).timestamp() - 2 * _GRANT_TTL
-        assert check_grant("tok", make_grant("tok", now=past)) is False
+        assert check_grant("tok", make_grant("tok", 0, now=past), 0) is False
+
+    def test_a_password_rotation_invalidates_an_old_grant(self):
+        # A grant minted at version 0 must fail once the link's password_version has been bumped —
+        # this is what makes changing a link password revoke outstanding grants immediately.
+        grant = make_grant("tok", 0)
+        assert check_grant("tok", grant, 0) is True
+        assert check_grant("tok", grant, 1) is False
 
     def test_malformed_grants_are_rejected_not_crashed(self):
         for bad in [None, "", "no-dot", "notanumber.sig"]:
-            assert check_grant("tok", bad) is False
+            assert check_grant("tok", bad, 0) is False
 
 
 class TestIsExpired: