feat: add claim token for re-download without re-paying

[kanishka0411]

Fixes #31

Adds a claim token so buyers can re-download if they close the tab after paying. Token is stored in localStorage, expires after 1 hour. New claim endpoint on the server side with rate limiting. Also added tests and a db migration for the new columns.

[keshav0479]

hey nice work! one thing to fix:

• add a format check on the token query param, reject anything that's not 64 hex chars before hitting the db

also minor: claim token regen block in pay.ts is duplicated, cleaner as a helper but not blocking

all feedback addressed

[keshav0479]

lgtm, merging