[ksprptr]

Adds public share links and follows with a repo-wide cleanup, security-audit,
and hardening pass. No breaking changes to the API contract or the deployment.

Public share links (new feature)

• Give any stored file a public, revocable URL on demand — nothing is public until
  the operator clicks. A 128-bit token maps to the file in a PublicLink row and
  serves it through /f/<token>/<name>, which streams the bytes (never redirecting
  to a signed storage URL that would outlive revocation). Scriptable types are
  always sent attachment + nosniff.
• The token is only an entry point: every fetch still runs the provider's own scope
  check, so a link can never reach outside the authorized tree. Links carry no
  expiry — a one-click revoke is the whole lifecycle.
• Workspace: a collapsible copy/open panel in the details pane, a green globe on
  shared files in the list, and the state is read back from the DB on load.

API hardening

• Map Prisma constraint errors (P2002/P2003/P2025) in the global exception filter,
  closing the disconnect() race that returned a 500 instead of a 404.
• Extract the busboy upload plumbing out of the controller into a helper.
• Paginate S3 folder listings (one ListObjectsV2 page + continuation token) so a
  large prefix no longer blocks the response.
• Add coverage for the google-enabled guard and the names id cap.

Web hardening

• Share the popup-menu primitives across FileBrowser and Breadcrumb.
• Enable eslint-plugin-react-hooks + @next/eslint-plugin-next and fix every
  exhaustive-deps warning; refresh the details panel after a share-state change.
• Log server errors from the standalone runtime via instrumentation.
• Rename utils to the .functions.ts convention.

Deps / infra

• Update dependencies (incl. @nestjs/terminus 12, googleapis 181, dotenv 18),
  prune dead dev tooling, drop the obsolete google-auth-library override, and pin
  the deepmerge-ts/uuid advisories (2 of 4 audit findings cleared; the rest are
  unreachable Prisma-tooling transitives).
• Drop dead env vars, remove a stale tsconfig flag, warn against exposing the API
  without a trusted proxy, and fix docker compose mangling the AUTH_PASSWORD hash.