Generate a secure link that works once and self-destructs after use.
3-64 characters: letters, numbers, hyphens, underscores
Default: 24 hours from now if left empty (no auto-expiry)