Download Chat Attachment

Stream a chat attachment by storage key.

Authz model: the signed token is the capability. Possession of a valid token grants read access for the token's TTL (7 days by default, matching the prior S3 presigned-URL behavior). The upload endpoint is still JWT-protected, so only authed users can ever obtain a valid token. <img src> cannot send Authorization headers, so the JWT trust model doesn't work here — signed URLs do.