fix(files): ending every session ends every API token, and the share links hold their folder

- A password reset or change, "log out everywhere" and a revoked untrusted password revoke all of the
  account's API tokens too (audited): one minted from a stolen session no longer outlives the answer.
- A bearer token or link grant with a non-ASCII character is refused (401/403), not a 500.
- Making a token's grants or a folder link holds the folder, so a racing delete cannot fail the
  foreign key; a link's view count is one atomic UPDATE.
- A folder link's card counts exactly the files its page lists (one `links.folder_files`).
- A file with no extension is served without a trailing dot.
- 0106's downgrade names a Hub folder so it never collides with one of the user's folders.
- The speed baseline reads share tokens through the app (the database keeps them hashed/encrypted).
- Tests: the token scope on the real session stack, the folder poster, the Hub refused for a link,
  0106's downgrade data step, 0107 without a key; docs/comments follow (three folder kinds, folder
  links, key change, the cleanup job's token warnings).

backend/app/routes/public.py

@@ -9,7 +9,7 @@ a short-lived signed grant that the media URL carries (a `<video src>` can't sen
 from fastapi import APIRouter, Depends, Request
 from fastapi.responses import FileResponse
 from pydantic import BaseModel
-from sqlalchemy import select
+from sqlalchemy import select, update
 from sqlalchemy.orm import Session
 
 from app.config import settings
@@ -22,7 +22,6 @@ from app.ratelimit import RateLimiter, client_key
 from app.security import verify_password
 from app.refusal import refused
 from app.routes._common import not_found
-from app.routes.files import MAX_LIST
 
 router = APIRouter(prefix="/api/public", tags=["public"])
 
@@ -37,9 +36,6 @@ _unlock_limit = RateLimiter(max_events=10, window_seconds=300)
 # already running when it fills are still checked — as many as the route's threadpool runs at once.
 _unlock_failures = RateLimiter(max_events=50, window_seconds=300)
 
-# The most files a folder link lists: as many as the owner's own Files list shows.
-_FOLDER_MAX = MAX_LIST
-
 
 def _link_or_404(db: Session, token: str) -> DownloadLink:
     link = linksmod.find(db, token)
@@ -89,16 +85,6 @@ def _ready_target(db: Session, link: DownloadLink) -> tuple[DownloadJob, MediaAs
     return _ready_job(db, db.get(DownloadJob, link.job_id))
 
 
-def _in_folder(link: DownloadLink, folder: FileFolder) -> tuple:
-    """What a folder link shows: the done files in its folder NOW, the folder owner's. A file moved
-    out stops opening through the link at its next request; one moved in starts."""
-    return (
-        DownloadJob.folder_id == link.folder_id,
-        DownloadJob.user_id == folder.user_id,
-        DownloadJob.status == JobStatus.DONE,
-    )
-
-
 def _link_folder(db: Session, link: DownloadLink) -> FileFolder:
     folder = db.get(FileFolder, link.folder_id) if link.folder_id is not None else None
     if folder is None:
@@ -109,7 +95,7 @@ def _link_folder(db: Session, link: DownloadLink) -> FileFolder:
 def _folder_job(db: Session, link: DownloadLink, job_id: int) -> tuple[DownloadJob, MediaAsset]:
     folder = _link_folder(db, link)
     job = db.execute(
-        select(DownloadJob).where(DownloadJob.id == job_id, *_in_folder(link, folder))
+        select(DownloadJob).where(DownloadJob.id == job_id, *linksmod.in_folder(folder))
     ).scalar_one_or_none()
     if job is None:
         raise refused(404, "video_gone")
@@ -136,16 +122,9 @@ def _poster_url(
 
 
 def _folder_meta(db: Session, link: DownloadLink, token: str, grant: str | None) -> dict:
-    """A folder link's page: the folder's name and each ready file's own watch metadata, newest
-    first. A file whose bytes are not on disk is left out, so the list never offers a dead row."""
+    """A folder link's page: the folder's name and each file's own watch metadata
+    (`linksmod.folder_files`: ready, on disk, newest first)."""
     folder = _link_folder(db, link)
-    rows = db.execute(
-        select(DownloadJob, MediaAsset)
-        .join(MediaAsset, MediaAsset.id == DownloadJob.asset_id)
-        .where(*_in_folder(link, folder), MediaAsset.status == "ready")
-        .order_by(DownloadJob.ready_at.desc().nulls_last(), DownloadJob.id.desc())
-        .limit(_FOLDER_MAX)
-    ).all()
     files = [
         {
             "id": job.id,
@@ -157,8 +136,7 @@ def _folder_meta(db: Session, link: DownloadLink, token: str, grant: str | None)
                 _poster_url(token, asset, grant, job.id),
             ),
         }
-        for job, asset in rows
-        if storage.safe_abs_path(settings.files_root, asset.rel_path) is not None
+        for job, asset in linksmod.folder_files(db, folder)
     ]
     return {
         "needs_password": False,
@@ -187,8 +165,13 @@ def _opened(db: Session, link: DownloadLink, token: str, grant: str | None = Non
         if link.folder_id is not None
         else _file_meta(db, link, token, grant)
     )
-    link.view_count += 1
-    db.flush()
+    # In SQL, not `+= 1` on the loaded row: two opens at once would both write the same count.
+    db.execute(
+        update(DownloadLink)
+        .where(DownloadLink.id == link.id)
+        .values(view_count=DownloadLink.view_count + 1)
+        .execution_options(synchronize_session=False)
+    )
     return meta