Add 'Never' expiry option for encrypted URLs

- Make ExpiresAt optional in CBOR (omitempty) for smaller tokens
- Treat ExpiresAt=0 as 'never expires' in parser
- URL-encode token with url.PathEscape() for safety
- Add 'Never' as default TTL option in generator form

internal/handlers/auth.go

@@ -126,12 +126,17 @@ func (s *Handlers) HandleGenerateURL() http.HandlerFunc {
 			quality = 85
 		}
 
-		if ttl <= 0 {
-			ttl = 2592000 // 30 days default
-		}
-
 		// Create payload
-		expiresAt := time.Now().Add(time.Duration(ttl) * time.Second)
+		// ttl=0 means never expires
+		var expiresAt time.Time
+		var expiresAtUnix int64
+
+		if ttl > 0 {
+			expiresAt = time.Now().Add(time.Duration(ttl) * time.Second)
+			expiresAtUnix = expiresAt.Unix()
+		}
+		// else expiresAtUnix stays 0 (never expires)
+
 		payload := &encurl.Payload{
 			SourceHost:  parsed.Host,
 			SourcePath:  parsed.Path,
@@ -141,7 +146,7 @@ func (s *Handlers) HandleGenerateURL() http.HandlerFunc {
 			Format:      imgcache.ImageFormat(format),
 			Quality:     quality,
 			FitMode:     imgcache.FitMode(fit),
-			ExpiresAt:   expiresAt.Unix(),
+			ExpiresAt:   expiresAtUnix,
 		}
 
 		// Generate encrypted token
@@ -153,18 +158,24 @@ func (s *Handlers) HandleGenerateURL() http.HandlerFunc {
 			return
 		}
 
-		// Build full URL
+		// Build full URL (URL-encode the token for safety)
 		scheme := "https"
 		if s.config.Debug {
 			scheme = "http"
 		}
 
 		host := r.Host
-		generatedURL := scheme + "://" + host + "/v1/e/" + token
+		generatedURL := scheme + "://" + host + "/v1/e/" + url.PathEscape(token)
+
+		// Format expiry for display
+		expiresAtStr := "Never"
+		if ttl > 0 {
+			expiresAtStr = expiresAt.Format(time.RFC3339)
+		}
 
 		s.renderGenerator(w, &generatorData{
 			GeneratedURL: generatedURL,
-			ExpiresAt:    expiresAt.Format(time.RFC3339),
+			ExpiresAt:    expiresAtStr,
 			FormURL:      sourceURL,
 			FormWidth:    widthStr,
 			FormHeight:   heightStr,