Serve a signed render link

Public endpoint — the HMAC signature in the URL is the auth boundary (no API key). Renders on the first hit and returns the image/PDF bytes; subsequent hits serve the cached copy. Normally you don't call this directly — embed the URL returned by POST /v1/render/link. The x-rendex-cache response header is hit or miss.