fix: address PR review — sanitize attachments, SSR safety, a11y

- Strip server paths from public attachment responses (new PublicAttachment type)
- Use $page.url.origin instead of window.location.origin (SSR-safe)
- Fix toggle switch left-4.5 → left-[1.125rem] (valid Tailwind)
- Add aria-label to SharingIndicator button for screen readers
- Add opportunistic pruning to IP rate limiter to prevent unbounded growth
- Reduce shared attachment cache to 1 hour (respect share revocation)
- Update OpenAPI schema with PublicAttachment type
- Add unit test asserting server paths are not leaked

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

docs/API.md

@@ -480,11 +480,10 @@ No authentication required. Returns the note content for a valid share token. Ra
   "attachments": [
     {
       "id": "id",
-      "noteId": "noteId",
       "filename": "filename",
       "mimeType": "mimeType",
       "size": 1,
-      "thumbnailPath": "thumbnailPath",
+      "featured": true,
       "createdAt": "2025-01-01T00:00:00.000Z"
     }
   ],