fix(api,frontend): isolate active share files and allowlist link schemes

frontend/src/lib/components/InlineButtons.svelte

@@ -1,5 +1,6 @@
 <script lang="ts">
   import type { InlineButton } from "$lib/api/types";
+  import { safeHref } from "$lib/format/url";
 
   interface Props {
     rows: InlineButton[][];
@@ -26,7 +27,12 @@
       {#each row as button, colIndex (colIndex)}
         {@const key = `${rowIndex}:${colIndex}`}
         {#if button.kind === "url" && button.url}
-          <a class="button" href={button.url} target="_blank" rel="noopener">
+          <a
+            class="button"
+            href={safeHref(button.url)}
+            target="_blank"
+            rel="noopener"
+          >
             <span class="label">{button.text}</span>
             <span class="corner">↗</span>
           </a>

frontend/src/lib/components/MediaVersionThumb.svelte

@@ -1,6 +1,6 @@
 <script lang="ts">
   import { type MediaResult, requestMediaVersion } from "$lib/api/client";
-  import { visualKind } from "$lib/api/media";
+  import { isActiveContent, visualKind } from "$lib/api/media";
   import type { MediaVersion } from "$lib/api/types";
   import Icon from "$lib/components/ui/Icon.svelte";
   import Spinner from "$lib/components/ui/Spinner.svelte";
@@ -48,7 +48,13 @@
       <span class="play"><Icon name="large-play" size="1.5rem" /></span>
     </a>
   {:else if result.state === "ready"}
-    <a class="file" href={result.url} target="_blank" rel="noopener">
+    <a
+      class="file"
+      href={result.url}
+      target="_blank"
+      rel="noopener"
+      download={isActiveContent(result.mime) ? `media_${version.id}` : undefined}
+    >
       <Icon name="document" size="1.125rem" />
       <span>{version.kind}</span>
     </a>

frontend/src/lib/components/WebPage.svelte

@@ -1,6 +1,7 @@
 <script lang="ts">
   import type { MessageView } from "$lib/api/types";
   import MessageMedia from "$lib/components/MessageMedia.svelte";
+  import { safeHref } from "$lib/format/url";
 
   interface Props {
     message: MessageView;
@@ -20,7 +21,7 @@
         <MessageMedia {message} {own} onopen={() => onmedia(0)} />
       </div>
     {/if}
-    <a class="card" href={web.url} target="_blank" rel="noopener">
+    <a class="card" href={safeHref(web.url)} target="_blank" rel="noopener">
       {#if web.site_name}
         <div class="site">{web.site_name}</div>
       {:else if web.display_url}

frontend/src/lib/components/profile/SharedLinks.svelte

@@ -7,6 +7,7 @@
   import Icon from "$lib/components/ui/Icon.svelte";
   import Spinner from "$lib/components/ui/Spinner.svelte";
   import { formatListDate } from "$lib/format/datetime";
+  import { safeHref } from "$lib/format/url";
   import { accounts } from "$lib/stores/accounts.svelte";
   import { ui } from "$lib/stores/ui.svelte";
 
@@ -94,7 +95,7 @@
             <span class="title">{item.web_title ?? host(item.url)}</span>
             <a
               class="url"
-              href={item.url}
+              href={safeHref(item.url)}
               target="_blank"
               rel="noopener"
               onclick={(event) => event.stopPropagation()}

frontend/src/lib/components/social/LinksPanel.svelte

@@ -6,6 +6,7 @@
   import EmptyState from "$lib/components/ui/EmptyState.svelte";
   import Icon from "$lib/components/ui/Icon.svelte";
   import Spinner from "$lib/components/ui/Spinner.svelte";
+  import { safeHref } from "$lib/format/url";
   import { accounts } from "$lib/stores/accounts.svelte";
   import { ui } from "$lib/stores/ui.svelte";
 
@@ -69,7 +70,12 @@
           {#if item.web_title}
             <span class="title">{item.web_title}</span>
           {/if}
-          <a class="url" href={item.url} target="_blank" rel="noopener">
+          <a
+            class="url"
+            href={safeHref(item.url)}
+            target="_blank"
+            rel="noopener"
+          >
             {item.url}
           </a>
           {#if item.web_site_name || item.web_description}