feat: harden file sharing and integrity

tests/test_access_provider.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import unittest
+from datetime import datetime, timedelta, timezone
 
 from sqlalchemy import create_engine, text
 from sqlalchemy.orm import sessionmaker
@@ -102,6 +103,15 @@ class FilesAccessProviderTests(unittest.TestCase):
                 target_id="campaign-1",
                 permission="read",
             ),
+            FileShare(
+                id="share-campaign-expired",
+                tenant_id=TENANT_ID,
+                file_asset_id=assets[2].id,
+                target_type="campaign",
+                target_id="campaign-1",
+                permission="read",
+                expires_at=datetime.now(timezone.utc) - timedelta(seconds=1),
+            ),
         ])
         session.commit()
         session.execute(