fix: add expiration to download tokens (30-day TTL)

From the PR description

Summary

• Adds an exp (Unix timestamp) field to every HMAC-signed download token
• verifyDownload rejects tokens whose exp is in the past
• Default TTL is 30 days - generous enough for links stored in chat history, bounded enough to limit exposure if the signing secret is ever rotated
• Old tokens without an exp field are still accepted (backward compat)

Closes #68

Changes

• backend/src/lib/downloadTokens.ts - signDownload gains optional ttlSeconds param (default 30 days); verifyDownload checks exp when present
• backend/src/lib/__tests__/downloadTokens.test.ts - 5 unit tests covering round-trip, tampering, exp field presence, rejection of expired tokens, and acceptance of valid tokens
• backend/vitest.config.ts + backend/package.json - vitest added

Test plan

• Unit tests: round-trip, tamper, exp field present, expired → null, valid → ok
• Build and typecheck pass Closes #91