Share a code by link instead of by instructions

Sending somebody a label meant sending a screenshot and a list of settings to
retype, and they would get one of them wrong. Copy share link hands them a URL
that reopens the generator with the content, the label, the copy count and
every layout value that was actually changed.

The whole payload rides in the fragment. A fragment is never transmitted, so it
does not reach Flask, it is not in the IIS log, and the proxy between them never
sees it - which matters because the content is usually an asset number or a
serial, and those have no business scattered through logs. It is NOT secrecy:
the link sits in a chat message and in browser history, and anyone holding it
can read the content. Secure Send exists for the case where that matters, and
the note under the box says so.

Only values that differ from a first-time visitor's defaults are carried, so
the link stays short enough to paste into a chat box; a shared link then wins
over the recipient's own saved settings, because somebody following one is
asking to see THAT code rather than their own last one. An unknown key is
ignored rather than refused, so a link made by a newer version still opens on
an older one. The picture is never carried - a data URL runs to megabytes.

Values are coerced back to the type the field holds. Everything arrives from a
URL as a string, and a nudge of 0 plus '2' is '02'.

Proven end to end: a link made in one browser, opened in a clean context with
no saved settings, rendering the same code.

CHANGELOG.md

@@ -12,6 +12,19 @@ ADR-007 and ADR-002.
 
 ### Added
 
+- **A link that opens the code generator with the work already in it.** Copy
+  share link hands somebody a URL that reopens the page with the content, the
+  label, the copy count and every layout value the sender changed - so "here is
+  the label, print it" is a link rather than a screenshot and a list of
+  settings to retype. Everything rides in the fragment, which browsers never
+  transmit: it does not reach Flask, the IIS log or the proxy in between. Only
+  the values that differ from a first-time visitor's defaults travel, so the
+  link stays short enough to paste into a chat box, and an unknown key is
+  ignored rather than refused, so a link made by a newer version still opens.
+  The picture never travels - a data URL runs to megabytes and no chat client
+  would carry it. This is convenience, not secrecy: anyone holding the link can
+  read the content, which is what Secure Send is for.
+
 - **Reading anything now needs a permission.** A sweep of the URL map found
   **165 GET routes that answered anybody with no token at all**: the whole
   asset inventory, every machine, PC, printer and network device, the USB