feat: add self-contained link composer

- Add structured URL codec with compact alphabets and dictionary support.
- Add public decode, redirect, and QR endpoints for composed links.
- Add authenticated encode API and link composer UI.
- Generate PNG QR codes via qrcode with Pillow support.
- Register the new blueprint and navigation entry.
- Cover public decode, auth gating, redirect URL parsing, and QR output.
- Bump NanoShare to 1.27.0 and lock new dependencies.

link_composer/security.py

@@ -0,0 +1,11 @@
+from urllib.parse import urlsplit
+
+from .constants import ALLOWED_REDIRECT_SCHEMES
+
+def validate_redirect_url(url: str) -> str:
+  parts = urlsplit(url)
+  if parts.scheme not in ALLOWED_REDIRECT_SCHEMES:
+    raise ValueError("decoded URL uses an unsupported redirect scheme")
+  if not parts.netloc:
+    raise ValueError("decoded URL has no host")
+  return url