feat(downloads): public share-by-link + watch page backend

Share a download by a capability URL (/watch/{token}) that anyone can play on a login-free page —
distinct from the registered-user ACL share. Per-link controls: optional expiry, allow-download
toggle (stream-only vs downloadable), optional argon2 password. Revoke = delete.
- migration 0042 + DownloadLink model; app/downloads/links.py (token, HMAC grant sign/verify)
- owner endpoints (POST/GET/PATCH/DELETE links) + /recipients for the internal user picker
- public router (no auth): watch meta / password unlock→signed grant / range-aware file serve
  (inline vs attachment); unlock is rate-limited; meta verifies the file exists on disk
Verified end-to-end: 206 range, inline vs attachment, wrong-password 403, tampered-grant 403.

backend/app/routes/public.py

@@ -0,0 +1,109 @@
+"""Public, login-free surface for shared download links (the `/watch/{token}` player page).
+
+These routes are deliberately OUTSIDE the auth/`require_human` gate — the unguessable token IS the
+credential (a capability URL). They only ever expose one file's stream + minimal metadata, never
+the app or any account data. Password-protected links exchange the password once at `/unlock` for
+a short-lived signed grant that the media URL carries (a `<video src>` can't send a header).
+"""
+from pathlib import Path
+
+from fastapi import APIRouter, Depends, HTTPException
+from fastapi.responses import FileResponse
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from app.config import settings
+from app.db import get_db
+from app.downloads import links as linksmod
+from app.downloads import storage
+from app.models import DownloadJob, DownloadLink, MediaAsset
+from app.ratelimit import RateLimiter
+from app.security import verify_password
+
+router = APIRouter(prefix="/api/public", tags=["public"])
+
+# Slow password guessing per link (the token itself is 192-bit, so it needs no throttle).
+_unlock_limit = RateLimiter(max_events=10, window_seconds=300)
+
+
+def _link_or_404(db: Session, token: str) -> DownloadLink:
+    link = db.execute(
+        select(DownloadLink).where(DownloadLink.token == token)
+    ).scalar_one_or_none()
+    if link is None or linksmod.is_expired(link):
+        raise HTTPException(status_code=404, detail="This link is no longer available.")
+    return link
+
+
+def _ready_asset(db: Session, link: DownloadLink) -> MediaAsset:
+    job = db.get(DownloadJob, link.job_id)
+    asset = db.get(MediaAsset, job.asset_id) if job and job.asset_id else None
+    if asset is None or asset.status != "ready" or not asset.rel_path:
+        raise HTTPException(status_code=404, detail="This video is no longer available.")
+    # Verify the file is actually on disk here (not just flagged ready), so the watch page never
+    # loads a player for a missing file — meta and file agree.
+    path = storage.abs_path(settings.download_root, asset.rel_path).resolve()
+    root = Path(settings.download_root).resolve()
+    if root not in path.parents or not path.exists():
+        raise HTTPException(status_code=404, detail="This video is no longer available.")
+    return asset
+
+
+def _file_url(token: str, grant: str | None = None) -> str:
+    base = f"/api/public/watch/{token}/file"
+    return f"{base}?g={grant}" if grant else base
+
+
+@router.get("/watch/{token}")
+def watch_meta(token: str, db: Session = Depends(get_db)) -> dict:
+    """Public metadata for the watch page. For a password link, returns only `needs_password`
+    until the viewer unlocks it (no title/thumbnail leak)."""
+    link = _link_or_404(db, token)
+    if link.password_hash:
+        return {"needs_password": True}
+    asset = _ready_asset(db, link)
+    link.view_count += 1
+    db.commit()
+    return {"needs_password": False, **linksmod.public_meta(link, asset, _file_url(token))}
+
+
+@router.post("/watch/{token}/unlock")
+def watch_unlock(token: str, payload: dict, db: Session = Depends(get_db)) -> dict:
+    """Exchange the link password for a signed grant carried by the media URL."""
+    if not _unlock_limit.allow(token):
+        raise HTTPException(status_code=429, detail="Too many attempts. Try again later.")
+    link = _link_or_404(db, token)
+    if not link.password_hash:
+        # Not a password link — nothing to unlock; just hand back the plain meta.
+        asset = _ready_asset(db, link)
+        return {"needs_password": False, **linksmod.public_meta(link, asset, _file_url(token))}
+    if not verify_password((payload.get("password") or ""), link.password_hash):
+        raise HTTPException(status_code=403, detail="Wrong password.")
+    asset = _ready_asset(db, link)
+    link.view_count += 1
+    db.commit()
+    grant = linksmod.make_grant(token)
+    return {"needs_password": False, **linksmod.public_meta(link, asset, _file_url(token, grant))}
+
+
+@router.get("/watch/{token}/file")
+def watch_file(token: str, g: str | None = None, db: Session = Depends(get_db)):
+    """Range-aware stream of the shared file. Inline by default (plays in the page); an
+    `allow_download` link serves it as an attachment. Password links require a valid grant."""
+    link = _link_or_404(db, token)
+    if link.password_hash and not linksmod.check_grant(token, g):
+        raise HTTPException(status_code=403, detail="This link needs a password.")
+    asset = _ready_asset(db, link)
+    path = storage.abs_path(settings.download_root, asset.rel_path).resolve()
+    root = Path(settings.download_root).resolve()
+    if root not in path.parents or not path.exists():
+        raise HTTPException(status_code=404, detail="This video is no longer available.")
+
+    ext = asset.container or path.suffix.lstrip(".")
+    base = storage.display_filename(asset.title or "video")
+    if base.lower().endswith(f".{ext.lower()}"):
+        base = base[: -(len(ext) + 1)]
+    filename = f"{base}.{ext}"
+    disposition = "attachment" if link.allow_download else "inline"
+    # Starlette's FileResponse honours the Range header (206) for seeking/scrubbing.
+    return FileResponse(path, filename=filename, content_disposition_type=disposition)