Artifacts access model: default-private + one-click magic link

Live demo: password-protected by default in every channel, plus a one-click magic link that unlocks then strips the token.