feat(downloads): share UI — user picker + public watch links + watch page

Rework the share dialog into two clear modes and add the public /watch player page:
- ShareDialog: (A) 'Share with a user' — autocomplete picker over registered users (was a blind
  email box that 404'd on non-users); (B) 'Share a link' — create/list/copy/revoke public links
  with allow-download toggle, optional expiry (1/7/30d), optional password; per-link view count.
- WatchPage: standalone login-free player at /watch/<token> (routed in main.tsx like /privacy),
  self-contained mini-i18n (en/hu/de by browser language); password gate → unlock → play; shows a
  Download button only when the link allows it.
- api: ShareLink/ShareRecipient types + link CRUD + recipients; share i18n (en/hu/de).
Verified end-to-end in a real browser: user picker, link create, public playback, stream-only vs
downloadable, password gate + unlock, no console errors.

frontend/src/lib/api.ts

@@ -710,6 +710,23 @@ export interface DownloadJob {
   user_email?: string;
 }
 
+export interface ShareRecipient {
+  id: number;
+  email: string;
+  display_name: string | null;
+}
+
+export interface ShareLink {
+  id: number;
+  token: string;
+  url: string; // path like "/watch/<token>" — prepend window.location.origin to share
+  allow_download: boolean;
+  has_password: boolean;
+  expires_at: string | null;
+  view_count: number;
+  created_at: string | null;
+}
+
 export interface DownloadUsage {
   footprint_bytes: number;
   active_jobs: number;
@@ -1073,6 +1090,22 @@ export const api = {
     req(`/api/downloads/${id}/share`, { method: "POST", body: JSON.stringify({ email }) }),
   unshareDownload: (id: number, email: string) =>
     req(`/api/downloads/${id}/share/${encodeURIComponent(email)}`, { method: "DELETE" }),
+  // Registered users this user can share with (for the internal picker).
+  shareRecipients: (): Promise<ShareRecipient[]> => req("/api/downloads/recipients"),
+  // Public watch links (share by link).
+  downloadLinks: (jobId: number): Promise<ShareLink[]> => req(`/api/downloads/${jobId}/links`),
+  createDownloadLink: (
+    jobId: number,
+    body: { allow_download?: boolean; expires_days?: number | null; password?: string }
+  ): Promise<ShareLink> =>
+    req(`/api/downloads/${jobId}/links`, { method: "POST", body: JSON.stringify(body) }),
+  updateDownloadLink: (
+    linkId: number,
+    patch: { allow_download?: boolean; expires_days?: number | null; password?: string }
+  ): Promise<ShareLink> =>
+    req(`/api/downloads/links/${linkId}`, { method: "PATCH", body: JSON.stringify(patch) }),
+  revokeDownloadLink: (linkId: number): Promise<{ deleted: number }> =>
+    req(`/api/downloads/links/${linkId}`, { method: "DELETE" }),
   // A plain <a> navigation can't send the X-Siftlode-Account header, so pass the active
   // account via ?account= (same wallet-gated selection the WebSocket uses) — otherwise the
   // download resolves to the session-default account and 404s for a per-tab account's file.