fix(sharing): address security review findings

- Use per-password random salt with PBKDF2-HMAC-SHA256 (stored as salt:hash)
- Increase PBKDF2 iterations to 600,000 (OWASP 2023 recommendation)
- Password for downloads now accepted via POST body (never URL query param)
- Fail download request if view count cannot be incremented (prevents bypass)
- Update tests to match new hashing format and POST password download

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

frontend/templates/shared_link_view.html

@@ -185,11 +185,13 @@
           return;
         }
 
-        // Attempt download — if password is wrong the server returns 403.
-        const url = `${DOWNLOAD_URL}?password=${encodeURIComponent(pwd)}`;
-
-        // Use a hidden iframe trick to detect errors vs. successful binary downloads.
-        fetch(url)
+        // Send the password in the POST body (never in the URL) to prevent it
+        // appearing in server access logs, browser history, or Referer headers.
+        fetch(DOWNLOAD_URL, {
+          method: 'POST',
+          headers: { 'Content-Type': 'application/json' },
+          body: JSON.stringify({ password: pwd }),
+        })
           .then(async (resp) => {
             if (resp.ok) {
               errEl.classList.add('hidden');