feat(files): share-link tokens are kept only hashed and encrypted, and every link change is audited

A /watch link's token is the credential, and it sat in the database as written. Migration 0107
replaces the column with the token's SHA-256 (the lookup) and a Fernet-encrypted copy (so the owner
can copy the same link again); every existing address keeps working, and the downgrade decrypts
them back. Without a copy this key can read, a link still opens but its address cannot be shown:
"Copy link" then takes the newest link that has one or makes a new one, and the Share dialog says
so in that row instead of a broken URL. Making, changing and revoking a link are audited, never
with its token or password.

frontend/src/lib/api/downloads.ts

@@ -140,8 +140,10 @@ export interface ShareRecipient {
 
 export interface ShareLink {
   id: number;
-  token: string;
-  url: string; // path like "/watch/<token>" — prepend window.location.origin to share
+  // Null when the server cannot show this link's address again (no encrypted copy its key reads): the
+  // link still opens for whoever has it; to share it anew, make a new link.
+  token: string | null;
+  url: string | null; // path like "/watch/<token>" — prepend window.location.origin to share
   allow_download: boolean;
   has_password: boolean;
   expires_at: string | null;
@@ -266,7 +268,7 @@ export const downloadsApi = {
     patch: { allow_download?: boolean; expires_days?: number | null; password?: string },
   ): Promise<ShareLink> =>
     req(`/api/downloads/links/${linkId}`, { method: "PATCH", body: JSON.stringify(patch) }),
-  revokeDownloadLink: (linkId: number): Promise<{ deleted: number }> =>
+  revokeDownloadLink: (linkId: number): Promise<{ ok: true; deleted: number }> =>
     req(`/api/downloads/links/${linkId}`, { method: "DELETE" }),
   // The library player's resume checkpoint. A position too early or too close to the end clears it.
   saveDownloadProgress: (