Security (low): password-protected public link reveals the item's name before the password #402

Where

server/src/routes/links.ts:101-104 (info): when unlocked() is false the answer is { name: <basename of the owner's path>, type, locked: true }. web/src/views/PublicLinkView.vue:115 renders info.name in the heading on the locked page as well.

What happens

Anyone who obtains the URL (a forwarded mail, browser history, a proxy log) learns the file or folder name without the password, for example Kuendigung_2026.pdf. The owner set a password to keep the item private, and the name is part of what it names. File requests already do this right: routes/fileRequests.ts:146 answers only the owner-written label while locked.

Steps

1. Create a public link with a password on any file.
2. GET /s/<token>/info with no cookie.
3. The JSON carries name and type; the page /s/<token> shows the file name above the password field.

Expected behaviour

While locked, info carries neither name nor type, and the page shows a generic heading (the app name plus a 'This link is protected' line) with the password field. After unlock the real name appears as today.

Fix

In info() return { locked: true } only; make name and type optional in PublicLinkInfo (shared/src/links.ts); in PublicLinkView.vue show the generic heading from the locale files (all three locales) while info.locked is true. Note the decision in DECISIONS.md.

Test that must fail without the fix

• server/test/publicLinks.test.ts: create a link with a password; GET /s/<token>/info without the unlock cookie: expect(body).not.toHaveProperty('name') and not.toHaveProperty('type'); after POST unlock with the right password, name is present.
• Playwright e2e/public-link.spec.ts (or the existing link spec): open a password link; before unlocking expect(page.getByRole('heading', { level: 1 })).not.toContainText(fileName); after unlocking it contains the name.

Found by the automatic review round (claude-fable-5-1, b739414); per CLAUDE.md the fix starts with a failing behaviour test.