Shared links can now upload and view every file

Anyone using a share link with write access can now upload files directly, completing the "view and add" promise of write-capable scoped shares. We also fixed two related issues where link viewers saw blank images or empty child collections: legacy collections migrated from older versions now properly cascade permissions to their children, and share links now include file access tokens for cascade-covered rows so images render for everyone with access.