feat: mint share tokens in the same hex style as note ids

__tests__/identifiers.test.ts

@@ -7,9 +7,9 @@ describe("opaque identifiers", () => {
     expect(newId()).toMatch(/^[0-9a-f]{32}$/);
   });
 
-  it("uses 128-bit URL-safe share credentials", () => {
+  it("mints share credentials in the same 128-bit hex style as note ids", () => {
     const tokens = Array.from({ length: 100 }, () => newShareToken());
     expect(new Set(tokens)).toHaveLength(tokens.length);
-    for (const token of tokens) expect(token).toMatch(/^[A-Za-z0-9_-]{22}$/);
+    for (const token of tokens) expect(token).toMatch(/^[0-9a-f]{32}$/);
   });
 });

lib/shareToken.ts

@@ -1,7 +1,7 @@
 import { randomBytes } from "crypto";
 
-// Share links are bearer credentials. Use 128 bits so they remain unguessable
-// even with many active links; existing shorter tokens continue to resolve.
+// Share links are bearer credentials. 128 bits, rendered as 32 hex chars so
+// /p/<token> reads like /note/<id>; existing base64url tokens still resolve.
 export function newShareToken() {
-  return randomBytes(16).toString("base64url");
+  return randomBytes(16).toString("hex");
 }