fix: address PR review — sanitize attachments, SSR safety, a11y

- Strip server paths from public attachment responses (new PublicAttachment type)
- Use $page.url.origin instead of window.location.origin (SSR-safe)
- Fix toggle switch left-4.5 → left-[1.125rem] (valid Tailwind)
- Add aria-label to SharingIndicator button for screen readers
- Add opportunistic pruning to IP rate limiter to prevent unbounded growth
- Reduce shared attachment cache to 1 hour (respect share revocation)
- Update OpenAPI schema with PublicAttachment type
- Add unit test asserting server paths are not leaked

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/API.md

@@ -480,11 +480,10 @@ No authentication required. Returns the note content for a valid share token. Ra
   "attachments": [
     {
       "id": "id",
-      "noteId": "noteId",
       "filename": "filename",
       "mimeType": "mimeType",
       "size": 1,
-      "thumbnailPath": "thumbnailPath",
+      "featured": true,
       "createdAt": "2025-01-01T00:00:00.000Z"
     }
   ],

docs/openapi.yaml

@@ -618,6 +618,24 @@ components:
       description: API key (crumbs_...)
 
   schemas:
+    PublicAttachment:
+      type: object
+      description: Sanitized attachment metadata for public sharing (no server paths)
+      properties:
+        id:
+          type: string
+        filename:
+          type: string
+        mimeType:
+          type: string
+        size:
+          type: integer
+        featured:
+          type: boolean
+        createdAt:
+          type: string
+          format: date-time
+
     SharedNoteData:
       type: object
       properties:
@@ -633,7 +651,7 @@ components:
         attachments:
           type: array
           items:
-            $ref: '#/components/schemas/Attachment'
+            $ref: '#/components/schemas/PublicAttachment'
         createdAt:
           type: string
           format: date-time