Fix the security audit's findings

ShareDownload::$authenticated was a public property without #[Locked],
so a visitor with a share's link but not its password could set it from
the browser and see the file list: names, folder paths, sizes and
whether the share holds a text. The contents stayed protected; the flag
is now locked, and a test tries to set it.

Sessions hold the keys of the password shares a recipient unlocked, and
were stored unencrypted in the sessions table wherever SESSION_ENCRYPT
was not set, which includes every Docker install. They are now
encrypted unless SESSION_ENCRYPT=false. Share keys never live in the
session, so every share stays readable; people sign in again once.

The container generated an APP_KEY when none was set, printed it to the
logs and generated another on the next start, which left the shares
without a password unreadable. It now refuses to start without one and
says how to create it; docker-compose.example.yml requires it for both
services. The command it names, and the README's, now pass
--entrypoint php: the image's entrypoint ignores its arguments, so
"docker run <image> php artisan key:generate --show" never ran it.

Every proxy is trusted, so the password-reset mail built its link from
a host a forged X-Forwarded-Host could choose. It is now built from
APP_URL.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

docker/entrypoint.sh

@@ -3,13 +3,14 @@ set -e
 
 cd /app
 
-# Auto-generate APP_KEY if not provided
+# APP_KEY decrypts the shares, so it must stay the same across restarts: a key made up here would
+# change on the next start and leave every existing share unreadable.
 if [ -z "$APP_KEY" ]; then
-    echo "[entrypoint] No APP_KEY set, generating one..."
-    APP_KEY=$(php artisan key:generate --show)
-    export APP_KEY
-    echo "[entrypoint] Generated APP_KEY: $APP_KEY"
-    echo "[entrypoint] WARNING: Set this APP_KEY in your docker-compose.yml to persist across restarts!"
+    echo "[entrypoint] APP_KEY is not set. Create one and set it for the app and the scheduler:" >&2
+    echo "[entrypoint]   docker run --rm --entrypoint php <this image> artisan key:generate --show" >&2
+    echo "[entrypoint] If this install ran without one before, use the key from its old logs" >&2
+    echo "[entrypoint] (\"Generated APP_KEY: ...\") so its shares stay readable." >&2
+    exit 1
 fi
 
 # A docker-compose.yml from before 2.1.1 mounts the SQLite volume over all of /app/database, so the