Add per-artifact public sharing

Any artifact can now be made publicly viewable via a share link, no login
required - opt-in per artifact, toggled from the feed UI next to Keep.

- Artifact.share_token: nullable, unique, high-entropy (secrets.token_urlsafe(32)).
  NULL = not shared; SQL treats each NULL as distinct so uniqueness still
  holds for the many not-shared rows.
- New public route GET /s/<token> (shared_artifact_view), completely
  unauthenticated, serving the same rendered/raw content as the owner
  route via a shared serve_artifact_file() helper.
- toggle_artifact_share: generates/clears the token: mirrors
  toggle_artifact_keep's pattern.
- Fixed a real gap this surfaced: embedded images in a shared artifact's
  content would otherwise break for an anonymous visitor, since asset_view
  was owner-only. It now also allows access when the asset's parent
  artifact is currently shared - unattached (orphaned) assets stay private
  regardless.
- serialize_artifact now reports is_shared/share_url so the API reflects
  sharing status (read-only for now; toggling stays UI-only).
- Feed UI: Share button (mirrors Keep's toggle interaction), a copyable
  share-link box that appears when shared, and a "shared" badge on the
  artifact row - distinct blue accent from Keep's green so both can be
  visible on the same row without confusion.

Verified live end-to-end (toggle on/off, public access, fake-token 404,
old-link-dies-on-unshare, embedded-asset access before/after sharing)
before writing the 12 automated tests in tests/views/test_sharing.py.
Also fixed two unrelated stale spots noticed in docs/api.md while adding
the Sharing section: the example response was missing is_kept/size_bytes,
and the raw-content table didn't list json/csv (added earlier this
session but never documented there).

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

artifacts/models.py

@@ -54,11 +54,19 @@ class Artifact(models.Model):
     read_at = models.DateTimeField(null=True, blank=True)
     is_kept = models.BooleanField(default=False)
     size_bytes = models.BigIntegerField(default=0)
+    # NULL = not shared. Many rows share NULL (SQL treats each NULL as
+    # distinct, so `unique=True` still holds); a real value must be unique
+    # since it's the sole credential for the unauthenticated /s/<token> route.
+    share_token = models.CharField(max_length=64, null=True, blank=True, unique=True, default=None)
 
     @property
     def is_unread(self):
         return self.read_at is None
 
+    @property
+    def is_shared(self):
+        return bool(self.share_token)
+
     class Meta:
         ordering = ["-created_at"]