feat: adopt Python 3.15 and harden caching and share links

- Switch local Python and the Docker base image to Python 3.15.
- Refresh locked dependencies with Python-version-specific resolution.
- Replace Pickle caching with native Redis strings, lists, and typed JSON.
- Validate cache TTLs and apply expiry atomically on Redis writes.
- Treat legacy binary cache values as misses and clear keys with SCAN.
- Ignore trailing prose after decoded spaces in share-link paths.
- Reject empty or slash-containing share IDs before database lookup.
- Add regression tests for plain and encoded spaces in share links.
- Update helper submodule for config lookup and tabular storage fixes.
- Update quart_common with JSON error response detection.
- Verify all 150 tests pass on CPython 3.15.0.

routes/side/main.py

@@ -129,9 +129,14 @@ async def file_delete_api(file_id, user):
   await current_app.convex.delete_file(file_id=file_id, user_id=user["sub"])
   return jsonify({"ok": True})
 
-@side_main_bp.route("/-<file_id>")
+@side_main_bp.route("/-<path:file_id>")
 @LIMITER.limit("20 per minute;500 per hour;")
 async def serve_file(file_id: str):
+  # Quart has already decoded %20; discard prose accidentally pasted after a link.
+  file_id = file_id.split(" ", 1)[0]
+  if not file_id or "/" in file_id:
+    abort(404)
+
   add_wide_event_context(nanoshare={"operation": "serve_file", "file_id": file_id})
   file_data = await current_app.convex.get_file(file_id=file_id)
   disable_logging = False