Encrypt file paths in API URLs using Fernet tokens

Raw filesystem paths were exposed in browser URLs, dev tools, and proxy logs.
Now all file-serving endpoints accept an opaque encrypted token (t= param)
derived from the session secret via HKDF, with a 4-hour TTL.

Backend:
- Add core/path_tokens.py with Fernet encrypt/decrypt (HKDF from .session_secret)
- Add file_token to all list/gallery/feed/search responses across 7 routers
- Accept optional t= param on all file-serving endpoints (backward compatible)

Frontend:
- Update 4 URL helpers in api.ts to prefer token when available
- Add 4 new helpers for paid-content/embedded-metadata URLs
- Update all 14 page/component files to pass file_token to URL builders
- Add file_token to all relevant TypeScript interfaces

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

web/backend/routers/review.py

@@ -36,6 +36,7 @@ from ..core.exceptions import (
     ValidationError
 )
 from ..core.responses import now_iso8601
+from ..core.path_tokens import encode_path, decode_path
 from modules.universal_logger import get_logger
 from modules.date_utils import DateHandler
 from ..core.utils import get_media_dimensions, get_media_dimensions_batch
@@ -244,9 +245,11 @@ async def get_review_queue(
             else:
                 width, height = dimensions_cache.get(row[1], (row[7], row[8]))
 
+            fp = row[1]
             file_item = {
                 "filename": row[2],
-                "file_path": row[1],
+                "file_path": fp,
+                "file_token": encode_path(fp) if fp else None,
                 "file_size": row[6] if row[6] else 0,
                 "added_date": row[10] if row[10] else '',
                 "post_date": row[11] if row[11] else '',
@@ -718,11 +721,14 @@ async def delete_review_file(
 @handle_exceptions
 async def get_review_file(
     request: Request,
-    file_path: str,
+    file_path: str = None,
     token: str = None,
+    t: str = None,
     current_user: Dict = Depends(get_current_user_media)
 ):
     """Serve a file from the review queue."""
+    if t:
+        file_path = decode_path(t)
     requested_file = Path(file_path)
 
     try: