fix(files): ending every session ends every API token, and the share links hold their folder

- A password reset or change, "log out everywhere" and a revoked untrusted password revoke all of the
  account's API tokens too (audited): one minted from a stolen session no longer outlives the answer.
- A bearer token or link grant with a non-ASCII character is refused (401/403), not a 500.
- Making a token's grants or a folder link holds the folder, so a racing delete cannot fail the
  foreign key; a link's view count is one atomic UPDATE.
- A folder link's card counts exactly the files its page lists (one `links.folder_files`).
- A file with no extension is served without a trailing dot.
- 0106's downgrade names a Hub folder so it never collides with one of the user's folders.
- The speed baseline reads share tokens through the app (the database keeps them hashed/encrypted).
- Tests: the token scope on the real session stack, the folder poster, the Hub refused for a link,
  0106's downgrade data step, 0107 without a key; docs/comments follow (three folder kinds, folder
  links, key change, the cleanup job's token warnings).

docs/self-hosting.md

@@ -44,7 +44,9 @@ The installer asks for the **public URL** where the instance will be reached (ju
   local `.env` file — keep that file private. **Do not change `TOKEN_ENCRYPTION_KEY` once the app has
   stored any secret** (Google credentials, API keys, SMTP password, Plex token): those values are
   encrypted with it, and a changed key makes them unreadable. If it is ever lost or rotated, clear the
-  affected rows from the `system_config` table and re-enter the secrets in the admin Configuration page,
+  affected rows from the `system_config` table and re-enter the secrets in the admin Configuration page.
+  Share links are kept with it too: after a key change every existing link still opens, but its
+  address can no longer be shown — its owner makes a new link to share it again,
 - pulls the image and starts the app + database,
 - prints the **setup wizard URL**, which looks like `…/setup?token=…`.
 
@@ -163,7 +165,9 @@ then cannot read its own secrets.
 2. **`.env`** — in particular `TOKEN_ENCRYPTION_KEY`. Your Google client secret, SMTP password, Plex
    token and every stored refresh token are encrypted with it *inside* the database. Restore a dump
    against a different key and those values are lost — you would have to clear the affected rows from
-   `system_config` and re-enter every secret by hand. Keep `.env` beside the dump, and just as private.
+   `system_config` and re-enter every secret by hand — and no existing share link's address can be
+   shown again (the links still open; their owners make new ones to share). Keep `.env` beside the
+   dump, and just as private.
 3. **Downloaded media** *(only if you use Files)* — the `siftlode_files` volume, or
    whatever `FILES_HOST_PATH` points at. Not needed to bring the instance back; the jobs and their
    metadata are in the database, the files themselves are not.