Create a password-protected share link for an item or collection.

Input for creating a share link.

Mirrors ShareLinkResponse on the wire, but created_by is Optional — a service-role principal has no human uuid, and the strict ShareLinkResponse (created_by: str) would 500 on that.

Extra fields are IGNORED (NOT allow) — this is a security boundary: the service returns the full DB row including password_hash, and only the safe fields enumerated here may reach a client. (The first version used extra=allow and leaked the hash; a real test caught it.)