Replace Psalm with PHPStan + PHP‑CS‑Fixer + Biome, add linting configs & cleanup

- Removed the `vimeo/psalm` dependency and all related files
(`psalm.xml`, `psalm‑baseline.xml`, suppress annotations).  
- Added **PHPStan** (v2.1.54) and **PHP‑CS‑Fixer** (v3.95.1) to
`vendor/bin/`.  
- Created `phpstan.neon` (level 5, bootstraps `app/bootstrap.php`,
scans `Parsedown.php`).  
- Created `phpstan‑baseline.neon` with 10 pre‑existing errors.  
- Added `.php‑cs‑fixer.dist.php` (PSR‑12 + PHP80Migration, targets
 `app/src` & `app/tests`).  
- Added `biome.json` and updated `justfile` to replace the old Psalm
recipes with `phpstan`, `cs‑check`, and `cs‑fix`.  
- Updated `.gitignore` to exclude PHPStan and PHP‑CS‑Fixer cache files.  
- Updated several JS files (`file‑preview.js`, `file‑upload‑queue.js`)
eand PHP controllers (`MediaController.php`, `SearchController.php`,
`SystemController.php`).  
- Minor adjustments to `TODO.md`, `app/src/Database.php`,
`app/src/Parsedown.php`, `app/src/ShareLink.php`, and
`app/src/SmtpRelay.php`.

app/src/ShareLink.php

@@ -46,9 +46,9 @@ class ShareLink
      * @param int        $createdBy    Admin user ID
      * @param string|null $password    Plain-text password (will be hashed), null = no password
      * @param string|null $expiresAt   ISO-8601 expiration date, null = never expires
-     * @return array                   The created link row
+     * @return array|null               The created link row
      */
-    public function create(int $createdBy, ?string $password = null, ?string $expiresAt = null, ?string $objetRestriction = null): array
+    public function create(int $createdBy, ?string $password = null, ?string $expiresAt = null, ?string $objetRestriction = null): ?array
     {
         $slug = self::generateSlug();
         $passwordHash = $password !== null ? password_hash($password, PASSWORD_BCRYPT) : null;