fix(share): tighten arc-paste edge + share-create UX

[bfirestone]

Summary

Three independent fixes that surfaced while reviewing the share-page experience end-to-end. Each commit is self-contained.

8a439e7 — Preserve quick-label comment_type through the popover

When a quick-label without a preset body (Nit / Issue / Suggestion / Question) routed the user into the comment popover for body text, the picked taxonomy was dropped — every saved annotation became a generic comment. Visually identical, taxonomically wrong, and arc share comments --json exposed the bug downstream too.

Fix: hold the picked label on the page state (pendingCommentType) and read it in handlePopoverSave before falling back to the suggestedText inference. Confirmed end-to-end: the JSON bundle now reports "comment_type": "nit" etc.

ffc0c6e — arc-paste: default-deny non-share routes at edge and in binary

arc-paste only legitimately serves /share/<id>, /api/paste/*, /_app/*, and /robots.txt. Previously the embedded SPA fallback handed back the arc app shell at /, and the SPA's /api/v1/* boot probes fell through to that fallback and returned HTML — which the browser then failed to JSON.parse.

Fix: default-deny at both layers (Caddyfile and the Echo router in main.go). Defense in depth so dev (no Caddy) and prod behave identically. Refactored run() to extract newRouter() so the same wiring is exercised in tests; new tests cover the / 404 and JSON-shaped 404 on /api/v1/*.

3103f62 — arc share create: drop --local/--share, add --remote, single URL by kind

The CLI used to print both the reviewer URL and the author URL on every successful create. Copy-pasting the wrong line handed recipients author privileges via the &t= token; for local shares the reviewer URL was actively misleading because nobody can reach a localhost link.

• Output is now one URL line, branching on share kind:
  • local → Preview URL (local-only — not reachable by others):
  • shared → Author URL (keep private — open it, then use the in-page Share link button to copy a reviewer URL):
• Reviewer URL is no longer CLI-printed in either mode. Authors get one by opening the link and clicking the in-page Share link button (already exists — copyShareLink strips &t=).
• --local was a no-op (already the default) → dropped.
• --share was the daily-driver "use my configured remote default" flag → renamed --remote (cleaner alongside --server; avoids the arc share create … --share --server foo stutter).
• --server <url> unchanged; still wins and forces shared mode.
• resolveServer signature simplified from (local, share, override) to (remote, override).

No backwards-compat alias — branch owner confirmed.

Test plan

• go test -count=1 ./cmd/arc/... ./arc-paste/... — passes locally
• bun run check && bun run test in web/ — svelte-check clean, 64 unit tests pass
• make build — frontend + binaries build with --webui tag
• Quick-label save: select text on a share, click quick-label icon → pick "Nit" → type a body → save. Inspect via arc share comments <id> --json; confirm "comment_type": "nit". Repeat for Issue / Suggestion / Question.
• arc-paste edge lockdown: curl -i https://<arcpaste-host>/ → 404; curl -i https://<arcpaste-host>/api/v1/projects → 404 with Content-Type: application/json; curl -i https://<arcpaste-host>/share/<id> → 200.
• share-create local: ./bin/arc share create /tmp/plan.md → exactly one URL line labeled Preview URL.
• share-create remote: ./bin/arc share create /tmp/plan.md --server http://localhost:7433 → exactly one URL line labeled Author URL.
• dropped flags: ./bin/arc share create plan.md --local and --share both error with unknown flag.
• reviewer URL flow: open the printed Author URL → click in-page Share link button → confirm clipboard URL contains #k=… and not &t=.