feat(one-time-downloads): add expiry and retry configuration

Introduce new environment variables to control the behavior of one-time download boxes:
- `WARPBOX_ONE_TIME_DOWNLOAD_EXPIRY_SECONDS`: Sets the lifetime of a one-time box after uploads are complete.
- `WARPBOX_ONE_TIME_DOWNLOAD_RETRY_ON_FAILURE`: Determines whether a box remains available if the ZIP creation or transfer fails.

To support these settings, the ZIP delivery process was refactored to use a temporary file. This ensures that a one-time box is only marked as consumed after the file has been successfully transferred to the client, preventing data loss on network interruptions.

Additionally, added a `DecorateFiles` helper in the box store to reduce code duplication.

lib/server/server.go

@@ -28,8 +28,7 @@ func Run(addr string) error {
 		return err
 	}
 
-	boxstore.SetUploadRoot(cfg.UploadsDir)
-	boxstore.SetOneTimeDownloadExpiry(cfg.OneTimeDownloadExpirySeconds)
+	applyBoxstoreRuntimeConfig(cfg)
 
 	store, err := metastore.Open(cfg.DBDir)
 	if err != nil {
@@ -44,6 +43,7 @@ func Run(addr string) error {
 	if err := cfg.ApplyOverrides(overrides); err != nil {
 		return fmt.Errorf("apply settings overrides: %w", err)
 	}
+	applyBoxstoreRuntimeConfig(cfg)
 
 	bootstrap, err := metastore.BootstrapAdmin(cfg, store)
 	if err != nil {
@@ -83,3 +83,8 @@ func Run(addr string) error {
 
 	return router.Run(addr)
 }
+
+func applyBoxstoreRuntimeConfig(cfg *config.Config) {
+	boxstore.SetUploadRoot(cfg.UploadsDir)
+	boxstore.SetOneTimeDownloadExpiry(cfg.OneTimeDownloadExpirySeconds)
+}