fix: add expiration to download tokens (30-day TTL)

[bmersereau]

Summary

• Adds an exp (Unix timestamp) field to every HMAC-signed download token
• verifyDownload rejects tokens whose exp is in the past
• Default TTL is 30 days — generous enough for links stored in chat history, bounded enough to limit exposure if the signing secret is ever rotated
• Old tokens without an exp field are still accepted (backward compat)

Closes #68

Changes

• backend/src/lib/downloadTokens.ts — signDownload gains optional ttlSeconds param (default 30 days); verifyDownload checks exp when present
• backend/src/lib/__tests__/downloadTokens.test.ts — 5 unit tests covering round-trip, tampering, exp field presence, rejection of expired tokens, and acceptance of valid tokens
• backend/vitest.config.ts + backend/package.json — vitest added

Test plan

• Unit tests: round-trip, tamper, exp field present, expired → null, valid → ok
• Build and typecheck pass
  Closes Nit PR #77: Missing test for backward-compat with pre-expiry tokens (no exp field) #91