harden anti-spam and file serving; backup restore to disk; json body limit

- Add honeypot field to public submission form + server-side check
- Serve shared files only in context of a valid share link (/api/share/:shareToken/files/:fileToken)
- Switch backup restore upload to diskStorage (50MB) with temp-dir cleanup
- Limit JSON body to 1mb
- Document fixed audit items

public/index.html

@@ -127,6 +127,8 @@ nav a:hover{color:var(--text)}
       <textarea id="descInput" placeholder="Опиши, что проходил, что делал на занятии..." required></textarea>
     </div>
 
+    <input type="text" name="website" id="hpWebsite" tabindex="-1" autocomplete="off" style="display:none" value="">
+
     <button class="btn" type="submit" id="submitBtn">Отправить</button>
   </div>
 </form>
@@ -314,6 +316,7 @@ form.addEventListener('submit', async (e) => {
   fd.append('student_name', studentName || document.getElementById('nameInput').value);
   fd.append('group_id', groupInput.value);
   fd.append('description', document.getElementById('descInput').value);
+  fd.append('website', document.getElementById('hpWebsite').value);
 
   try {
     const res = await fetch(`${API}/api/entries`, { method: 'POST', body: fd });