fix(server): reduce JWT expiry to 72h and use UUIDv4 for attachment IDs

JWT tokens were valid for 30 days, giving stolen tokens a long attack
window. Reduced to 72 hours per security audit LOW-2.

Attachment IDs used UUIDv7 which embeds millisecond timestamps, allowing
attackers to narrow the UUID search space. Switched to UUIDv4 (fully
random) per security audit LOW-3.

LOW-1 (WebSocket CORS wildcard) was already resolved — checkOrigin
validates against an allowlist.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

server/internal/handler/auth.go

@@ -70,7 +70,7 @@ func (h *Handler) issueJWT(user db.User) (string, error) {
 		"sub":   uuidToString(user.ID),
 		"email": user.Email,
 		"name":  user.Name,
-		"exp":   time.Now().Add(30 * 24 * time.Hour).Unix(),
+		"exp":   time.Now().Add(72 * time.Hour).Unix(),
 		"iat":   time.Now().Unix(),
 	})
 	return token.SignedString(auth.JWTSecret())

server/internal/handler/file.go

@@ -153,8 +153,7 @@ func (h *Handler) UploadFile(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 
-	// Generate a UUIDv7 to use as both the attachment ID and S3 key.
-	id, err := uuid.NewV7()
+	id, err := uuid.NewRandom()
 	if err != nil {
 		slog.Error("failed to generate uuid", "error", err)
 		writeError(w, http.StatusInternalServerError, "internal error")