feat(downloads): share UI — user picker + public watch links + watch page

Rework the share dialog into two clear modes and add the public /watch player page:
- ShareDialog: (A) 'Share with a user' — autocomplete picker over registered users (was a blind
  email box that 404'd on non-users); (B) 'Share a link' — create/list/copy/revoke public links
  with allow-download toggle, optional expiry (1/7/30d), optional password; per-link view count.
- WatchPage: standalone login-free player at /watch/<token> (routed in main.tsx like /privacy),
  self-contained mini-i18n (en/hu/de by browser language); password gate → unlock → play; shows a
  Download button only when the link allows it.
- api: ShareLink/ShareRecipient types + link CRUD + recipients; share i18n (en/hu/de).
Verified end-to-end in a real browser: user picker, link create, public playback, stream-only vs
downloadable, password gate + unlock, no console errors.

frontend/src/main.tsx

@@ -6,6 +6,7 @@ import ErrorBoundary from "./components/ErrorBoundary";
 import { ConfirmProvider } from "./components/ConfirmProvider";
 import PrivacyPolicy from "./components/legal/PrivacyPolicy";
 import Terms from "./components/legal/Terms";
+import WatchPage from "./components/WatchPage";
 import "./i18n";
 import "./index.css";
 
@@ -19,7 +20,8 @@ const queryClient = new QueryClient({
 const path = window.location.pathname;
 const root =
   path === "/privacy" ? <PrivacyPolicy /> :
-  path === "/terms" ? <Terms /> : (
+  path === "/terms" ? <Terms /> :
+  path.startsWith("/watch/") ? <WatchPage /> : (
     <QueryClientProvider client={queryClient}>
       <ErrorBoundary>
         <ConfirmProvider>