Short-link safety contract

Resolve the exact link, owner, project, alias and status from current server data before updating it.
Treat target URLs, public aliases, access flags and bearer tokens as sensitive. Never return bearer tokens or private redirect data.
Change only requested fields and preserve the server's expected-version and idempotency contract.
Rotation or revocation requires an explicit request, confirm=true, current concurrency data and a fresh idempotency key.
Report the link ID, alias, affected fields, resulting status and server readback.