api: expose links as opaque id

It's considered poor form to directly expose database primary keys to
the API. Re-work API to expose links as opaque tokens which, under the
covers, are actually base64 encoded uuids.