[Guests] Authenticate a guest via the emailed link on a resolve page #2823

User Story

• As a guest who has received an invitation link by email, I want to click the link and be authenticated on a resolve page (similar to how a public link resolves), so that I can gain access to the resource I was invited to without needing a full OpenCloud account, for a limited, renewable session.

Context

Reference: opencloud-eu/opencloud#2517 (comment) for the detailled authentication mechanics.

User value

Guest authentication

Technical notes

There are two tokens involved:

1. The invitation link contains a token which is not suitable to authenticate requests, but only to trade it for a JWT session token. It might have a long lifetime than the guest session (not guaranteed though).
2. The guest session granted by resolving that link is short-lived (24 hours). It holds a JWT which can authenticate requests.

Expiry of the session does not invalidate the link; the recipient renews by authenticating again.

Acceptance Criteria

• Clicking a guest invitation link opens a dedicated resolve page in the Web UI, similar to the existing public-link resolve page.
• The resolve page authenticates the link (token from url), as described in the referenced issue comment, trading it for a short lived (24h) JWT which is then used as bearer token for authenticating all requests towards the backend.
• The JWT is stored in the sessionStorage
• On successfully resolving the email link into a guest session with JWT session token, the guest is redirected to the resource they were invited to (redirect target derived from the JWT, not from a user-supplied parameter).
• While the guest session is valid, the guest can navigate, refresh, and work in the shared resources
• Shortly before the JWT expires a toast is shown that the session will expire soon (15 minutes before expiry). This is important to be able to persist unsaved changes.
• After the JWT expired:
  • web retrieves a 401 error with token_expired or session_expired on any request, which also includes a share id.
  • web sends a POST with the share id from the 401 to a renew endpoint, which will generate a new magic token and sends an email to the user.
  • web displays a page, similar to our "logged out" page for regular users, informing the user that the guest session expired and that they should check their email inbox
• If the initial link/token is invalid, revoked, or the invitation has expired, the resolve page shows an error state and does not grant a session.
• The resolve page does not leak resource identifiers or invitation metadata before authentication succeeds.