fix(download): pin frontend link generation to fixed relay config

The runtime kept reading aksrt_download_config after the settings page was
removed, so the frontend still issued download links per the stale option
values instead of the built-in defaults.

- Pin endpoint, per-token uses and TTL to built-in constants and drop all
  option reads plus the is_enabled() master switch
- Remove the now-unreachable direct-download branches from the download
  box template and the paid-card download helper
- Lock the pinned contract in the download contract tests

tests/widget-system/download-config-contract.test.cjs

@@ -8,13 +8,19 @@ const test = require('node:test');
 const root = path.resolve(__dirname, '..', '..');
 const read = (file) => fs.readFileSync(path.join(root, file), 'utf8');
 
-test('Download.php derives endpoint, ttl and max uses from configuration', () => {
+test('download relay configuration is pinned to built-in constants', () => {
   const dl = read('src/Content/Download.php');
 
-  // Dead hard-coded values are gone.
-  assert.doesNotMatch(dl, /const ENDPOINT/);
-  assert.doesNotMatch(dl, /const TOKEN_TTL/);
-  assert.doesNotMatch(dl, /aksrt-dl/);
+  // The admin settings page is gone; the option must never be read again.
+  assert.doesNotMatch(dl, /aksrt_download_config/);
+
+  // The retired master switch is gone from the runtime.
+  assert.doesNotMatch(dl, /function is_enabled/);
+
+  // Single source of truth: fixed endpoint, per-token uses and TTL.
+  assert.match(dl, /const ENDPOINT\s*=\s*'download'/);
+  assert.match(dl, /const MAX_USES\s*=\s*1/);
+  assert.match(dl, /const TTL_MINUTES\s*=\s*10/);
 
   // Rewrite regex and URL building share the configured alias.
   assert.match(dl, /preg_quote\(\$this->config\(\)\['endpoint'\], '\/'\)/);
@@ -23,11 +29,34 @@ test('Download.php derives endpoint, ttl and max uses from configuration', () =>
   assert.match(dl, /flush_rewrite_rules\(false\)/);
   assert.match(dl, /aksrt_dl_rewrite_version/);
 
-  // TTL and per-token max uses come from the settings section.
+  // TTL and per-token max uses come from the fixed configuration.
   assert.match(dl, /'expires_in'\s+=> \$config\['ttl'\]/);
   assert.match(dl, /'max_uses'\s+=> \(int\) \$config\['max_uses'\]/);
 });
 
+test('the retired master switch leaves no direct-download branches behind', () => {
+  const dl = read('src/Content/Download.php');
+  const box = read('templates/parts/resource-download-box.php');
+  const pay = read('inc/helpers/aksrt-pay.php');
+
+  // No runtime switch and no option reads remain.
+  assert.doesNotMatch(dl, /function is_enabled/);
+  assert.doesNotMatch(dl, /aksrt_download_config/);
+
+  // Direct mode was only reachable through the removed switch.
+  assert.doesNotMatch(box, /direct_download/);
+  assert.doesNotMatch(pay, /direct_download/);
+
+  // Relay buttons stay the only download path on both surfaces; the login
+  // anchor and the paid-card relay button keep their original markup.
+  assert.match(box, /data-action="<\?php echo esc_attr\(\$btn_action\); \?>/);
+  assert.match(box, /href="<\?php echo esc_url\(\$btn_href\); \?>/);
+  assert.match(pay, /data-action="aksrt-download"/);
+
+  // Dead standalone-page helper stays removed.
+  assert.doesNotMatch(pay, /aksrt_is_download_alone_page_enabled/);
+});
+
 test('usage is counted only after full delivery, never for probes', () => {
   const dl = read('src/Content/Download.php');
 
@@ -89,31 +118,3 @@ test('token generation retries on primary-key collisions', () => {
   assert.match(dl, /PRIMARY KEY\(token\) already guarantees uniqueness/);
   assert.match(dl, /for \(\$attempt = 0; \$attempt < 3; \$attempt\+\+\)/);
 });
-
-test('master switch off puts the token system to sleep and renders direct links', () => {
-  const dl = read('src/Content/Download.php');
-  const box = read('templates/parts/resource-download-box.php');
-  const pay = read('inc/helpers/aksrt-pay.php');
-
-  // The switch is a public runtime check; missing key means enabled.
-  assert.match(dl, /public function is_enabled\(\): bool/);
-  assert.match(dl, /!isset\(\$cfg\['enabled'\]\) \|\| !empty\(\$cfg\['enabled'\]\)/);
-
-  // Rewrite, REST routes and token serving all bail out when disabled.
-  assert.match(dl, /if \(!\$this->is_enabled\(\)\) \{\s*return;\s*\}/);
-  assert.match(dl, /Master switch off: the token system is retired/);
-
-  // The unused policy endpoint stays removed.
-  assert.doesNotMatch(dl, /download\/policy/);
-  assert.doesNotMatch(dl, /rest_policy/);
-
-  // Direct mode renders anchors to the raw source URL instead of token buttons.
-  assert.match(box, /\$direct_download = class_exists\('\\AKSRT\\Content\\Download'\)/);
-  assert.match(box, /elseif \(\$direct_download\) \{/);
-  assert.match(box, /href="<\?php echo esc_url\(\$btn_href\); \?>/);
-  assert.match(box, /data-clipboard-text="<\?php echo esc_attr\(\$extract_code\); \?>/);
-  assert.match(pay, /if \(\$direct_download\) \{\s*\$buttons \.= '<a class="mr10 but /);
-
-  // Dead standalone-page helper stays removed.
-  assert.doesNotMatch(pay, /aksrt_is_download_alone_page_enabled/);
-});