Mobile share and open-in: share target, deep links, share out #29

Part of #14 (W3 — mobile v1). Blocked by transfers + files slices.

Outcome

put.io participates in Android's share fabric: content flows in from other apps and files flow out.

Scope

• Share target: receive URLs/magnets from other apps → prefilled add-transfer flow; receive text with links gracefully — shipped: #159. File export, share-out, deep links and post-add confirmation shipped in #163.
• Open-in/out: share a file through a scoped Android content URI or local export with temporary recipient permission; never place a token-bearing direct download URL on the system share sheet
• Intent filters + deep links registered per the shell's reserved routes
• Post-share confirmation with a path back into the app (toast/notification → transfer)

Non-goals (v1)

Public/revocable link creation, DocumentsProvider integration, and widgets. Public links remain post-v1 under #43; v1 share-out must not emulate them with credential-bearing download URLs.

Acceptance criteria

• DoD: verify green; screen recording of sharing a magnet from a browser into put.io and sharing a file out attached
• Automated coverage proves no OAuth/download token or signed media URL reaches the chooser payload, logs, notifications, or durable state