fix(api,frontend): isolate active share files and allowlist link schemes

frontend/src/lib/api/media.ts

@@ -76,6 +76,18 @@ export function isPreviewable(kind: string, mime: string | null): boolean {
   return PREVIEW_MIME_PREFIXES.some((prefix) => mime?.startsWith(prefix));
 }
 
+const ACTIVE_MIMES = new Set([
+  "text/html",
+  "application/xhtml+xml",
+  "image/svg+xml",
+  "text/xml",
+  "application/xml",
+]);
+
+export function isActiveContent(mime: string | null): boolean {
+  return ACTIVE_MIMES.has(mime?.split(";", 1)[0].trim().toLowerCase() ?? "");
+}
+
 export type VisualKind = "image" | "video" | "other";
 
 const VIDEO_KINDS = new Set(["video", "video_note", "animation", "gif"]);