Add read-only sharing, API tokens and OpenAPI spec

- Share a note as a live read-only page at /s/{token} with optional password and expiry
- Share page renders with the shared parser (TOC, footnotes, math, Mermaid, code highlighting)
  and only serves images from the note's own .assets directory
- Shares follow renames made through the API or externally
- Manage shares and API tokens from the command palette and file tree
- Accept read/write API tokens as Bearer credentials; management endpoints require a session
- Serve a hand-written openapi.json, checked against the route table in tests

cmd/rawmark/main.go

@@ -94,8 +94,9 @@ func run(addr string) error {
 	}
 	go cleanupSessions(ctx, st)
 
-	srv := api.New(v, am, hub, idx)
+	srv := api.New(v, am, st, hub, idx)
 	srv.OnSetup = func() { os.Remove(codeFile) }
+	go srv.FollowMoves(ctx)
 	httpServer := &http.Server{
 		Addr:              addr,
 		Handler:           srv.Handler(web.Dist()),