Persist the signed download token in files.token

[acoshift]

Summary

• Store the full signed download token (fn-{hmac}) in a new files.token column at upload time, so the api's dropbox.List can rebuild working download URLs without holding sign_key.

Why

PR #17 made the HMAC signature mandatory: GET /files/{token} runs parseToken first and 404s anything without a valid tag. But dropbox.List (in apiserver) builds its downloadUrl from the bare fn — it has no sign_key, so every link it returns is a dead /files/{fn} that fails the HMAC check. Persisting the token dropbox already computes is the simplest fix; the alternative (sharing sign_key with the api) couples key rotation across services.

How

• schema/03_token.sql + schema.sql: add token text not null default ''. The default keeps the migration safe for existing rows — they carry an empty token until they self-expire (≤7-day max TTL), which is no worse than today (links are already broken).
• uploadHandler computes the token once, writes it to the new column, and reuses it for the response downloadUrl (previously recomputed inline).

Schema migration

alter table files add column token text not null default '';

(dropbox's schema/*.sql migrator is not run at startup — apply out-of-band, same as other columns.)

Deploy ordering

1. Apply the migration above.
2. Deploy dropbox (this PR) — new uploads start populating token.
3. Deploy apiserver (deploys-app/apiserver companion PR) — reads token for dropbox.List.

Test plan

• go test ./... passes
• TestUpload_Success now asserts the token in downloadUrl is persisted verbatim to files.token.

🤖 Generated with Claude Code