feat: add password-protected friendly attachment links

[andrei-hasna]

Summary

• add authenticated, read-only friendly slug availability checks
• add password-mandatory friendly aliases through link regeneration
• reuse the existing hashed share-token model and unique index; no migration
• expose the capability through CLI, cloud client, OpenAPI, and generated SDK

Task

References OPE10-00014 (8a5f4fb2-3073-4c26-9146-06a8294860e0).

Verification

• regression first: GET /v1/slugs/company-closing-packet returned 404 before implementation
• focused lane: 70 passed, 0 failed
• bun run verify:release: exit 0
• shield review: exit 0 on the staged candidate
• gitleaks commit-range scan: exit 0, empty JSON report
• source CLI help exposes attachments slug <slug> and attachments link --slug

Safety

• no attachment or project document was uploaded or shared
• no production data, link, or deployment was mutated
• friendly aliases require a password because their URLs are guessable

Stop before merge. The coordinator's fixed independent reviewer must review exact head
a9586e97c7f42a9a221bb20adad1580e5e6c727b.

---

^{Need help on this PR? Tag @codesmith-bot with what you need. Autofix is disabled.}

[andrei-hasna]

[REVIEW] GO — #29 @ a9586e9 — lens: correctness+security+gates, reviewer Aruns (1 of 1)

Exact candidate reviewed

• Base: origin/main at c1234a6.
• Head: a9586e9.
• Read: the full merge-base diff for all 23 changed files (625 insertions, 19 deletions), plus surrounding implementation and tests in the SQLite and Postgres stores, local/API store adapters, cloud transport, authenticated v1 routes, unauthenticated public-share routes, share-access policy, password hashing and throttle, schema migrations, OpenAPI/SDK, CLI wiring, and the repository test wrapper.

Commands and exact results

• git log --oneline origin/main..HEAD — exit 0; one commit: a9586e9 feat: add password-protected friendly attachment links.
• git diff origin/main...HEAD --stat — exit 0; 23 files changed, 625 insertions, 19 deletions.
• git diff origin/main...HEAD — exit 0; full diff read.
• bun install — exit 0; setup only, 159 packages installed. Its prepare hook built successfully, but this is not counted as a repository gate.
• bun run typecheck — exit 0; the command emitted no pass/fail count and no TypeScript diagnostics (one typecheck lane passed, zero failed).
• bun run test — exit 0; exact repository summary: Checks: 58 total, 58 passed, 0 failed.

Blocking P0/P1 findings

• None. The friendly slug is validated and hashed before storage, password presence is enforced at both local and HTTP creation boundaries, the slug forces a server-hosted link, API creation/availability remain scope-protected, public downloads still verify the password through the shared access policy, duplicate races terminate at the existing unique token-hash constraint, and both declared gates pass.

Non-blocking follow-ups

• None required for this PR. Coverage note only: the declared gates are hermetic and do not exercise a live external Postgres/S3 deployment; that is not a required gate here.