Public source-download endpoint for the chat file-card ‘Open’ link.
Mirrors public_preview_file for resolution (UUID file id or
legacy cross-user path) but always returns
Content-Disposition: attachment; filename="..." so the browser
saves under the source filename instead of trying to render the
bytes inline. Used by InlineFilePreview ‘Open’ affordances
that render as plain <a href>: those clicks — plus middle-
click / right-click “open in new tab” / “copy link” — don’t carry
the frontend’s bearer token, so the auth’d
/api/files/download/{file_id} route would 401 every plain
browser navigation.
The file_id is the only required capability, matching the
existing public/preview contract. relative_path is
intentionally NOT supported: ‘Open’ always targets the registered
source artifact, never a sub-path inside it.