share: the key never travels in a URL

The share page used to put the key in the API path, and every embedded
picture or video carried it in its src, so a reverse proxy's access log
held whole links. The page now sends the key in the body of
POST /api/share/{token}. The answer sets a diary_share cookie
(__Secure- over HTTPS) scoped to /api/share/{token}/, HttpOnly,
SameSite=Strict, good for twelve hours, and signed over the key's hash.
Media is served from /api/share/{token}/media/{id} only to a browser
holding that cookie, so minting a new key or unsharing voids it.

The old /api/share/{token}/{key} routes are gone; links themselves are
unchanged, since the key was always in their fragment.

web/src/lib/api.ts

@@ -468,7 +468,7 @@ export const api = {
   backupNow: () => request<BackupStatus>('/backup', { method: 'POST' }),
 
   readShared: (token: string, key: string) =>
-    request<SharedDocument>(`/share/${encodeURIComponent(token)}/${encodeURIComponent(key)}`),
+    request<SharedDocument>(`/share/${encodeURIComponent(token)}`, { method: 'POST', body: body({ key }) }),
 
   sessions: () => request<SignedIn[]>('/sessions'),
   revokeSession: (id: string) =>