fix(api,frontend): isolate active share files and allowlist link schemes

frontend/src/lib/components/InlineButtons.svelte

@@ -1,5 +1,6 @@
 <script lang="ts">
   import type { InlineButton } from "$lib/api/types";
+  import { safeHref } from "$lib/format/url";
 
   interface Props {
     rows: InlineButton[][];
@@ -26,7 +27,12 @@
       {#each row as button, colIndex (colIndex)}
         {@const key = `${rowIndex}:${colIndex}`}
         {#if button.kind === "url" && button.url}
-          <a class="button" href={button.url} target="_blank" rel="noopener">
+          <a
+            class="button"
+            href={safeHref(button.url)}
+            target="_blank"
+            rel="noopener"
+          >
             <span class="label">{button.text}</span>
             <span class="corner">↗</span>
           </a>