fix(share): close two holes in the public content route

Both from Cursor, both real, both in the byte-range work rather than the view
migration.

**The per-share ceiling was bypassable with any non-start Range.** The limit was
gated on `isReadStart(range)` so a player scrubbing a video would not 429 every
other visitor to the link. But that predicate was read before knowing whether
the file was media, and only media honours `Range` — every other response
ignores the header and returns the whole body. So `Range: bytes=1-` on a shared
PDF took the full download and never touched the share budget.

The exemption now applies only where the response actually is byte-served.
Media still gets its free seeks; everything else is charged unconditionally.

**Shares classified media differently than the workspace does.** This route
keyed off the stored `file.contentType`; `serve/[...path]` keys off
`getContentType(displayName)`. Uploads routinely land as
`application/octet-stream`, so a shared `.mp4` fell out of the byte-range branch,
lost `Accept-Ranges`, and could not be scrubbed — while the identical file stayed
seekable inside the workspace. Now classified by filename as well as stored type,
which is a superset of what the workspace path accepts, so nothing that is
seekable there is unseekable here.

`rangeHeader` is read once at the top now instead of twice, since both the limit
decision and the audit row need it.

Suite: 20951 passed. files API: 267 passed.

Author: waleedlatif1

apps/sim/app/api/files/public/[token]/content/route.ts

@@ -68,6 +68,21 @@ export const GET = withRouteHandler(
         return NextResponse.json({ error: auth.error ?? 'auth_required_password' }, { status: 401 })
       }
 
+      const { file } = resolved
+      const rangeHeader = request.headers.get('range')
+
+      /**
+       * Whether this file is byte-served. Classified from the filename as well
+       * as the stored type, matching how the workspace serve path decides
+       * (`getContentType(displayName)`): uploads frequently land as
+       * `application/octet-stream`, and keying only off `file.contentType` meant
+       * a shared `.mp4` silently lost `Accept-Ranges` while the very same file
+       * stayed seekable inside the workspace.
+       */
+      const isMedia =
+        isMediaContentType(file.contentType) ||
+        isMediaContentType(getContentType(file.originalName))
+
       /**
        * The share is only known after the token resolves, so the aggregate
        * per-share ceiling is enforced here rather than alongside the per-IP
@@ -77,28 +92,28 @@ export const GET = withRouteHandler(
        *
        * A seek within an in-progress playback is charged nothing: the ceiling is
        * shared by every visitor to the link, so counting each of a player's range
-       * requests would let one person scrubbing a video 429 everyone else. Same
-       * rule as the audit row below, from the same predicate.
+       * requests would let one person scrubbing a video 429 everyone else.
+       *
+       * That exemption is scoped to responses that actually honour `Range`.
+       * Every other path ignores the header and returns the whole body, so
+       * reading the predicate unconditionally let `Range: bytes=1-` on any
+       * non-media file collect the full download for free.
        */
-      if (isReadStart(request.headers.get('range'))) {
+      if (!isMedia || isReadStart(rangeHeader)) {
         const shareLimited = await enforcePerShareRateLimit('content', resolved.share.id)
         if (shareLimited) return shareLimited
       }
 
-      const { file } = resolved
-
       /**
        * Media is byte-served so a shared video or track is seekable and never
        * resident in memory on either side. Taken before the download because
        * the buffered path below exists for the generated-document swap, which
        * no media file can be subject to.
        */
-      if (isMediaContentType(file.contentType)) {
+      if (isMedia) {
         const head = await headObject(file.key, 'workspace')
         if (!head) throw new FileNotFoundError('Not found')
 
-        const rangeHeader = request.headers.get('range')
-
         logger.info('Public shared media served', {
           shareId: resolved.share.id,
           key: file.key,