CVE-2026-62684: File Browser: Share API exposes the password hash and bypass token

When a user creates a password-protected share or lists existing shares, the JSON response includes the full bcrypt password_hash and the secret token of the share. The Link storage struct is serialized directly with json.Marshal and tags password_hash and token for output, with no field filtering. Any authenticated user receives these secrets for their own shares, and an administrator listing all shares via GET /api/shares receives the password hash and bypass token for every user’s shares, enabling offline cracking of share passwords and direct password-bypass access to protected shares.