Stream a GCS file directly to the caller

Downloads a file from Google Cloud Storage and streams it as a binary response with a Content-Disposition: attachment header.

When to use: Use this endpoint when the caller can present API credentials and wants to receive file bytes in the HTTP response body. When the consumer cannot authenticate against this API (e.g. browser redirects, third-party delivery), use GET /storage/presigned-url instead, which returns a URL requiring no further authentication.

Preconditions: Requires a valid JWT. The filePath parameter must be a plain relative path (e.g. documents/report.pdf); the full GCS URI form (gs://bucket-name/...) is NOT accepted by this endpoint, unlike /storage/presigned-url. Paths are sanitized: values containing ../, leading slashes, backslashes, repeated slashes (//), or the characters <>:"|?* are rejected with 400. Multi-segment paths are also rejected with 400 when the first path segment contains a dot or is exactly "file" (e.g. reports.q1/data.csv, file/report.pdf).

The optional fileName parameter sets the filename in the Content-Disposition header. When omitted, the filename defaults to the last segment of filePath. The Content-Type header is inferred from the file extension; when the resolved name has no extension, a .csv extension is appended.

Response: A streaming binary body. Response headers include Content-Disposition: attachment; filename="<resolved-name>" and a Content-Type inferred from the file extension. No files are modified; this operation has no side effects.