feat(share): send from inside the share sheet — the Teams-style in-extension picker

Replaces the wrong approach (stage + try to bounce into the app, which iOS blocks)
with the one Teams/WhatsApp actually use: the picker and the send happen INSIDE the
share extension, so there's no app-open at all. Tap Share → Biz Connect → pick a
chat → it uploads and sends, right there in the sheet.

How the extension can send without the app: it's a separate process that can't see
the web app's HttpOnly cookie, so:
- server: GET /api/share/token mints a bearer token for the logged-in user.
- web: on every launch the app fetches that token and hands it to the extension via
  the App Group (ShareInbox.setAuth writes token+base to the shared UserDefaults).
- extension: reads the token and calls the SAME API the native client uses —
  GET /api/messages/conversations to list chats, POST /api/messages/upload for each
  file, POST /api/messages to send. Native UITableView picker with search.

Robustness: it still stages the files + writes a manifest first, so if there's no
token yet (user never signed in) or the send fails, the file isn't lost — the app
collects it on next open, exactly as before. On success the manifest is cleared so
the app doesn't re-offer it.

Server + web are live now; the token endpoint is harmless until a build ships the
extension. NEEDS A NEW iOS BUILD for the picker itself.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

server/routes.js

@@ -304,6 +304,19 @@ route('POST', '/api/auth/refresh', async (req, res) => {
   json(res, 200, { ok: true, token: tok, expiresAt: now() + SESSION_TTL, refreshToken: newRefresh, refreshExpiresAt: now() + REFRESH_TTL });
 });
 
+// Mint a bearer token for the iOS Share Extension. The extension is a separate process that can't see the
+// web app's HttpOnly `sid` cookie, so the logged-in web app calls this on boot and hands the token to the
+// extension via the App Group. The extension then talks to the API directly (list chats, upload, send) —
+// exactly like the native client, so no app-open is needed to share. Short-ish TTL, refreshed each boot.
+route('GET', '/api/share/token', async (req, res) => {
+  const u = currentUser(req);
+  if (!u) return json(res, 401, { error: 'unauthorized' });
+  const tok = A.token();
+  const ttl = 1000 * 60 * 60 * 24 * 30; // 30 days; the app re-mints on every launch anyway
+  R.authSessions.create({ token: tok, userId: u.id, mfaPassed: true, ttl });
+  json(res, 200, { token: tok, expiresAt: now() + ttl });
+});
+
 // Login step 2: TOTP code -> marks session mfa_passed
 route('POST', '/api/login/mfa', async (req, res) => {
   const { code } = await readBody(req);