feat(downloads): public share-by-link + watch page backend

Share a download by a capability URL (/watch/{token}) that anyone can play on a login-free page —
distinct from the registered-user ACL share. Per-link controls: optional expiry, allow-download
toggle (stream-only vs downloadable), optional argon2 password. Revoke = delete.
- migration 0042 + DownloadLink model; app/downloads/links.py (token, HMAC grant sign/verify)
- owner endpoints (POST/GET/PATCH/DELETE links) + /recipients for the internal user picker
- public router (no auth): watch meta / password unlock→signed grant / range-aware file serve
  (inline vs attachment); unlock is rate-limited; meta verifies the file exists on disk
Verified end-to-end: 206 range, inline vs attachment, wrong-password 403, tampered-grant 403.

backend/app/main.py

@@ -38,6 +38,7 @@ from app.routes import (
     messages,
     notifications,
     playlists,
+    public as public_routes,
     quota,
     saved_views,
     scheduler as scheduler_routes,
@@ -125,6 +126,7 @@ app.include_router(playlists.router)
 app.include_router(saved_views.router)
 app.include_router(downloads.router)
 app.include_router(downloads.admin_router)
+app.include_router(public_routes.router)
 app.include_router(admin.router)
 app.include_router(config_routes.router)
 app.include_router(scheduler_routes.router)