Let expired customer links keep accepting uploads

uploadAuth now only blocks archived/missing tokens. A new
requireNotExpired middleware sits in front of /files, /file and /zip,
so the file browser closes (410 Gone) once the link expires while the
upload form stays open. /info reports the expired flag so the page can
hide the browser section and show a warning banner.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

public/upload.html

@@ -234,8 +234,11 @@ async function init() {
     return;
   }
   const data = await r.json();
+  window._uploadInfo = data;
   document.getElementById('title').textContent = `Upload für ${data.name}`;
-  if (data.expires_at) {
+  if (data.expired) {
+    info.innerHTML = `<span class="expires" style="color:var(--warn,#f59e0b); border-color:var(--warn,#f59e0b)">⚠ Link ist abgelaufen — Uploads sind weiterhin möglich, der Datei-Browser ist deaktiviert.</span>`;
+  } else if (data.expires_at) {
     info.innerHTML = `<span class="expires">⏳ gültig bis ${new Date(data.expires_at).toLocaleString()}</span>`;
   } else {
     info.textContent = 'Lade Dateien oder ganze Ordner hoch — die Ordnerstruktur bleibt erhalten.';
@@ -269,10 +272,19 @@ function renderCrumbs() {
 async function loadFiles() {
   const browser = document.getElementById('fileBrowser');
   const count = document.getElementById('fileCount');
+  // Browser komplett ausblenden wenn Link abgelaufen ist
+  if (window._uploadInfo && window._uploadInfo.expired) {
+    document.querySelector('.browser').style.display = 'none';
+    return;
+  }
   renderCrumbs();
   try {
     const url = `/u/${token}/files${currentDir ? '?dir=' + encodeURIComponent(currentDir) : ''}`;
     const r = await fetch(url, { headers: authHeaders() });
+    if (r.status === 410) {
+      document.querySelector('.browser').style.display = 'none';
+      return;
+    }
     if (!r.ok) { browser.innerHTML = '<div class="empty">Konnte Dateien nicht laden.</div>'; count.textContent = ''; return; }
     const data = await r.json();
     const entries = data.entries || [];