fix(api,frontend): isolate active share files and allowlist link schemes

frontend/src/lib/components/social/LinksPanel.svelte

@@ -6,6 +6,7 @@
   import EmptyState from "$lib/components/ui/EmptyState.svelte";
   import Icon from "$lib/components/ui/Icon.svelte";
   import Spinner from "$lib/components/ui/Spinner.svelte";
+  import { safeHref } from "$lib/format/url";
   import { accounts } from "$lib/stores/accounts.svelte";
   import { ui } from "$lib/stores/ui.svelte";
 
@@ -69,7 +70,12 @@
           {#if item.web_title}
             <span class="title">{item.web_title}</span>
           {/if}
-          <a class="url" href={item.url} target="_blank" rel="noopener">
+          <a
+            class="url"
+            href={safeHref(item.url)}
+            target="_blank"
+            rel="noopener"
+          >
             {item.url}
           </a>
           {#if item.web_site_name || item.web_description}