fix(files): ending every session ends every API token, and the share links hold their folder

- A password reset or change, "log out everywhere" and a revoked untrusted password revoke all of the
  account's API tokens too (audited): one minted from a stolen session no longer outlives the answer.
- A bearer token or link grant with a non-ASCII character is refused (401/403), not a 500.
- Making a token's grants or a folder link holds the folder, so a racing delete cannot fail the
  foreign key; a link's view count is one atomic UPDATE.
- A folder link's card counts exactly the files its page lists (one `links.folder_files`).
- A file with no extension is served without a trailing dot.
- 0106's downgrade names a Hub folder so it never collides with one of the user's folders.
- The speed baseline reads share tokens through the app (the database keeps them hashed/encrypted).
- Tests: the token scope on the real session stack, the folder poster, the Hub refused for a link,
  0106's downgrade data step, 0107 without a key; docs/comments follow (three folder kinds, folder
  links, key change, the cleanup job's token warnings).

backend/tests/test_storage.py

@@ -96,6 +96,9 @@ class TestDownloadFilename:
     def test_does_not_double_an_extension_already_present(self):
         assert download_filename("clip.mp4", "mp4", Path("/x/f.mp4")) == "clip.mp4"
 
+    def test_no_extension_is_served_without_a_trailing_dot(self):
+        assert download_filename("Makefile", None, Path("/x/upload-7")) == "Makefile"
+
     def test_falls_back_to_the_file_suffix_when_no_container(self):
         assert download_filename("song", None, Path("/x/f.m4a")) == "song.m4a"