Add revocable public share links for saved lists and routes

[Medformatik]

Problem

Current deep links can encode a location or client state, but saved lists and routes cannot be published through a stable link, updated intentionally, revoked, or given a bounded lifetime.

Current state

• Web Share/clipboard can create client-side links for locations and current map state.
• There is no server-side share resource, opaque token, anonymous resolver, expiry, or revocation UI.
• Private account resources must not become addressable by predictable internal IDs.

Proposed solution

Add a narrow public-share capability for saved collections and routes. Use opaque high-entropy tokens, store only a token hash, and make the owner choose whether a link is an immutable snapshot or a live view of the current resource.

Acceptance criteria

• A share records owner, target type/ID, mode (snapshot/live), creation/update time, optional expiry, and revocation.
• Tokens are cryptographically random, non-enumerable, shown only when minted, and stored hashed at rest.
• Anonymous resolution returns a purpose-built public representation and never leaks owner email, internal IDs, ACLs, drafts, or private metadata.
• Revocation and expiry take effect immediately across API, caches, previews, and clients.
• Owners can list, copy, rotate, and revoke links and see their mode/last update.
• Snapshot links remain stable when the source changes; live links reflect only explicitly public fields.
• Deleted accounts/resources follow a documented tombstone/not-found policy.
• Responses set deliberate robots, referrer, cache, and security headers; default behavior prevents search indexing unless explicitly chosen.
• Rate limits and abuse controls cover token probing and expensive anonymous rendering.
• Shared routes retain required provider/source attribution and handle unavailable routing data gracefully.
• Tests cover token entropy, authorization, rotation, expiry races, cache invalidation, and accidental field exposure.
• Existing stateless location deep links continue to work without requiring an account/server record.

Alternatives considered

Encoding entire collections/routes in the URL exposes data and cannot be revoked. Requiring every viewer to sign in defeats public sharing.

Area

Saved data, routes, API, public web rendering, account settings.

Dependencies

Public representations must follow the user-data trust decision in #312; private member-based sharing is tracked separately in #294.