feat(downloads): one-click Share + downloadable-by-default links (E7 S3)

D2-A: the library row's Share button becomes a single action — quickShareLink()
ensures a public link (minting on demand), copies it to the clipboard, and toasts
with an "Open in new tab" action. A copy failure still toasts (warning) with that
action so the link is never a dead end. Advanced controls (password/expiry/revoke/
user-ACL) stay in the existing ShareDialog, reached via a new "Manage sharing" row
button.

D1 (forward-only): CreateLinkIn.allow_download defaults to true, so a newly minted
link is downloadable by default. The default lives in the API, not a migration —
the download_links column default stays false, so no existing link flips. The
ShareDialog create-default is flipped to match.

Tests: TestCreateLinkDefault (default true; explicit false honored); 4 vitest cases
for quickShareLink (mint-vs-reuse, copy ok/fail, create failure). HU/EN parity.

frontend/src/components/ShareDialog.tsx

@@ -254,7 +254,9 @@ function LinkShare({ job }: { job: DownloadJob }) {
     queryFn: () => api.downloadLinks(job.id),
   });
   const [creating, setCreating] = useState(false);
-  const [allowDownload, setAllowDownload] = useState(false);
+  // D1 (E7 S3): downloadable by default — matches the one-click Share (which relies on the backend
+  // default) and the common "let them have the file" intent. The owner can uncheck it here.
+  const [allowDownload, setAllowDownload] = useState(true);
   const [expiryDays, setExpiryDays] = useState<number | null>(null);
   const [password, setPassword] = useState("");
   const invalidate = () => qc.invalidateQueries({ queryKey: qk.downloadLinks(job.id) });
@@ -276,8 +278,8 @@ function LinkShare({ job }: { job: DownloadJob }) {
   });
 
   // Open with a link already generated: sharing is almost always the goal, so mint a default
-  // (no password, no expiry, view-only) link the moment the dialog finds none — as if the user
-  // had pressed "New link" → "Create". All further controls (password, download toggle, expiry,
+  // (no password, no expiry, downloadable per D1) link the moment the dialog finds none — as if the
+  // user had pressed "New link" → "Create". All further controls (password, download toggle, expiry,
   // extra links, revoke) stay available on the created link and via the "New link" button.
   const autoTried = useRef(false);
   useEffect(() => {