Fix N+1 queries in workspace list and share activity; close activity IDOR

Commit notes

- Workspace list: batch member counts with one GROUP BY query instead of one COUNT per workspace (twice over). - Share activity: batch resource-name lookups per resource type with inArray instead of one query per link via Promise.all; cap the link list at 200 rows (was unbounded). - Replace raw SQL id interpolation with a parameterized inArray. - The activity shareLinkId filter now verifies the link belongs to the requesting user; previously any link id exposed its activity. - Sanitize zip entry file names in the share-link zip download.

[private session redacted]