feat(api): add API documentation and ShareX integration

- Add an API documentation page with curl and ShareX examples.
- Implement a dynamic ShareX configuration endpoint (`/api/v1/sharex/warpbox-anonymous.sxcu`) that generates a `.sxcu` file pre-configured with the instance's base URL.
- Update anonymous uploads to return a private management link (`manageUrl`) and a deletion link (`deleteUrl`) in JSON responses.
- Update README with details on Stage 3 Anonymous Integrations.
- Add styling for the new API documentation view and management details.

backend/libs/services/upload_test.go

@@ -0,0 +1,124 @@
+package services
+
+import (
+	"bytes"
+	"io"
+	"log/slog"
+	"mime/multipart"
+	"net/http/httptest"
+	"os"
+	"path/filepath"
+	"strings"
+	"testing"
+)
+
+func TestDeleteTokenVerification(t *testing.T) {
+	service := newTestUploadService(t)
+	result := createTestBox(t, service, "file.txt", "hello")
+	box := getTestBox(t, service, result.BoxID)
+	token := tokenFromManageURL(t, result.ManageURL)
+
+	if box.DeleteTokenHash == "" {
+		t.Fatalf("DeleteTokenHash was not stored")
+	}
+	if strings.Contains(box.DeleteTokenHash, token) {
+		t.Fatalf("DeleteTokenHash contains the raw token")
+	}
+	if !service.VerifyDeleteToken(box, token) {
+		t.Fatalf("VerifyDeleteToken rejected the correct token")
+	}
+	if service.VerifyDeleteToken(box, "wrong-token") {
+		t.Fatalf("VerifyDeleteToken accepted the wrong token")
+	}
+}
+
+func TestDeleteBoxWithTokenRemovesMetadataAndFiles(t *testing.T) {
+	service := newTestUploadService(t)
+	result := createTestBox(t, service, "file.txt", "hello")
+	box := getTestBox(t, service, result.BoxID)
+	token := tokenFromManageURL(t, result.ManageURL)
+
+	if _, err := os.Stat(filepath.Join(service.filesDir, box.ID)); err != nil {
+		t.Fatalf("box files were not created: %v", err)
+	}
+	if err := service.DeleteBoxWithToken(box.ID, "wrong-token"); err == nil {
+		t.Fatalf("DeleteBoxWithToken accepted the wrong token")
+	}
+	if _, err := service.GetBox(box.ID); err != nil {
+		t.Fatalf("box was deleted after wrong token: %v", err)
+	}
+
+	if err := service.DeleteBoxWithToken(box.ID, token); err != nil {
+		t.Fatalf("DeleteBoxWithToken returned error: %v", err)
+	}
+	if _, err := service.GetBox(box.ID); !os.IsNotExist(err) {
+		t.Fatalf("GetBox after delete error = %v, want os.ErrNotExist", err)
+	}
+	if _, err := os.Stat(filepath.Join(service.filesDir, box.ID)); !os.IsNotExist(err) {
+		t.Fatalf("box directory still exists after delete: %v", err)
+	}
+}
+
+func newTestUploadService(t *testing.T) *UploadService {
+	t.Helper()
+	service, err := NewUploadService(1024*1024, t.TempDir(), "http://example.test", slog.New(slog.NewTextHandler(io.Discard, nil)))
+	if err != nil {
+		t.Fatalf("NewUploadService returned error: %v", err)
+	}
+	t.Cleanup(func() {
+		if err := service.Close(); err != nil {
+			t.Fatalf("Close returned error: %v", err)
+		}
+	})
+	return service
+}
+
+func createTestBox(t *testing.T, service *UploadService, filename, body string) UploadResult {
+	t.Helper()
+	result, err := service.CreateBox(testFileHeaders(t, "file", filename, body), UploadOptions{MaxDays: 1})
+	if err != nil {
+		t.Fatalf("CreateBox returned error: %v", err)
+	}
+	return result
+}
+
+func getTestBox(t *testing.T, service *UploadService, boxID string) Box {
+	t.Helper()
+	box, err := service.GetBox(boxID)
+	if err != nil {
+		t.Fatalf("GetBox returned error: %v", err)
+	}
+	return box
+}
+
+func testFileHeaders(t *testing.T, field, filename, body string) []*multipart.FileHeader {
+	t.Helper()
+	var payload bytes.Buffer
+	writer := multipart.NewWriter(&payload)
+	part, err := writer.CreateFormFile(field, filename)
+	if err != nil {
+		t.Fatalf("CreateFormFile returned error: %v", err)
+	}
+	if _, err := part.Write([]byte(body)); err != nil {
+		t.Fatalf("part.Write returned error: %v", err)
+	}
+	if err := writer.Close(); err != nil {
+		t.Fatalf("writer.Close returned error: %v", err)
+	}
+
+	request := httptest.NewRequest("POST", "/upload", &payload)
+	request.Header.Set("Content-Type", writer.FormDataContentType())
+	if err := request.ParseMultipartForm(1024 * 1024); err != nil {
+		t.Fatalf("ParseMultipartForm returned error: %v", err)
+	}
+	return request.MultipartForm.File[field]
+}
+
+func tokenFromManageURL(t *testing.T, manageURL string) string {
+	t.Helper()
+	parts := strings.Split(strings.TrimRight(manageURL, "/"), "/")
+	if len(parts) == 0 {
+		t.Fatalf("empty manage URL")
+	}
+	return parts[len(parts)-1]
+}