fix: move sensitive packet context out of URLs

[mergemaven11]

Closes #186

What changed

• Replace authenticated packet builder/export GET endpoints with POST-only JSON-body routes for performance review, v12 platform, promotion, interview, and certification packets.
• Remove the legacy sensitive GET packet routers from application registration so organization/reviewer/notes/requirement context cannot be carried in query strings.
• Update the frontend packet transport to send native JSON bodies for previews and PDF exports.
• Replace shared-packet ?code= access with a POSTed access-code form and a short-lived HttpOnly signed grant cookie.
• Bind grant expiry into the server-verified signature and cap it by the share's own expiration.
• Add targeted rate limiting for shared-packet access attempts.
• Add configuration for the share grant secret/TTL/cookie security behavior.

Privacy/security properties

• Raw packet notes, item notes, organization, reviewer, target organization, credential requirement notes, and similar context no longer need to appear in authenticated packet URLs.
• Shared-packet access codes are not copied into page URLs, redirect URLs, download links, or grant-cookie values.
• Legacy GET builder/export routes are expected to be unavailable.

Regression coverage

• POST-only route contract and sensitive body handling.
• Legacy GET rejection.
• Clean access-code redirect/cookie behavior and server-enforced grant expiry.
• Shared-access rate-limit policy.

Merge gate

Do not merge unless Backend, Frontend, and Security CI are all green on the exact current head, the branch remains current with main, and there are no unresolved blocker findings.

[mergemaven11]

Tuesday/Friday engineering sweep triage: this remains the highest-priority actionable fix for #186, but it is not safe to merge as-is. Its exact head ab86dce7a3aa061fb336a7b55e2a5411e0b82a32 previously passed Backend, Frontend, and Security CI, but the branch is now stale against protected main and GitHub reports it non-mergeable. It must be refreshed onto current main and all required checks rerun on the resulting exact head before merge.

[mergemaven11]

Superseded by #205, which reapplies the packet privacy remediation directly onto current protected main and is being revalidated on its exact head. Closing this stale/non-mergeable PR so #186 has one active remediation path.