Security: Share link password stored and transmitted in plaintext via JWT

[Fengsh0923]

Problem

In permission.guard.ts, validateBaseSharePasswordToken() compares payload.password === baseShare.password in plaintext. The share password appears stored unhashed, and the JWT carries the plaintext password.

Suggested Fix

1. Store share passwords as bcrypt/argon2 hashes
2. JWT should only contain shareId + nonce, not the password
3. Validate by hashing user input against stored hash

Found during source code review. v1.10.0