fix: move sensitive packet context out of URLs on current main

[mergemaven11]

Closes #186.

Supersedes stale PR #193. This replacement reapplies the already-reviewed packet privacy remediation directly onto current protected main, without overwriting the newer Aisha, CI, or changelog work.

What changed

• Use POST JSON bodies for authenticated packet builder/export routes instead of sensitive query strings.
• Remove legacy sensitive GET packet routers from app registration.
• Send packet previews and PDF exports through JSON bodies in the frontend.
• Replace shared-packet ?code= access with a POSTed access-code form and short-lived HttpOnly signed grant cookie.
• Bound grant lifetime, apply Secure/SameSite/path cookie controls, and rate-limit access-code attempts.
• Add regression coverage for POST-only routes, legacy GET rejection, clean share access, grant expiry, and rate limiting.

Merge gate

Merge only if Backend CI, Frontend CI, and Security CI are green on this exact current head, the PR remains current/mergeable, and review threads are resolved.