ZERO-INSTALL delivery: ensure session + register file + return a public relay download URL

Primary entry point for AI agents. If no session is active, creates one, then registers the file for public HTTP download. Returns a downloadUrl like https://srift.app/d/<token> the recipient can fetch with any HTTP client (browser, srift get, wget, curl) — SRIFT install on the recipient side is NOT required. This is a relay link: when it is opened, this daemon streams the bytes on demand through the srift.app relay (pass-through, Cache-Control: no-store). Nothing is stored on any server, so the link works only while this daemon (or the process hosting it) runs. encrypt: true (or a password) makes it end-to-end encrypted with AES-256-GCM; the key is returned in the URL's #k= fragment, which is never sent to a server. Without it the link is protected by TLS in transit only. Optional maxDownloads and ttlMs enforce sharing limits; failed/cancelled downloads do not count against the cap. Tokens survive transient signaler reconnects. Note: requires the local SRIFT daemon (http://127.0.0.1:3822) — filesystem access to filePath is not available on the public https://srift.app host. Several files: pass filePaths for one .tar.gz bundle link (default) or bundle:false for one link per path, created in parallel; the response then has links[] and errors[].