fix(api,frontend): isolate active share files and allowlist link schemes

frontend/src/lib/components/profile/SharedLinks.svelte

@@ -7,6 +7,7 @@
   import Icon from "$lib/components/ui/Icon.svelte";
   import Spinner from "$lib/components/ui/Spinner.svelte";
   import { formatListDate } from "$lib/format/datetime";
+  import { safeHref } from "$lib/format/url";
   import { accounts } from "$lib/stores/accounts.svelte";
   import { ui } from "$lib/stores/ui.svelte";
 
@@ -94,7 +95,7 @@
             <span class="title">{item.web_title ?? host(item.url)}</span>
             <a
               class="url"
-              href={item.url}
+              href={safeHref(item.url)}
               target="_blank"
               rel="noopener"
               onclick={(event) => event.stopPropagation()}