Download voice note file by ID (from GCS or local storage).

Signed in, and only for a conversation the caller is in (2026-09-18 route-auth review). Until then this served anybody's recorded voice to anybody who named the id, with no token at all. voiceService.js, the one caller, already sends the token.

A plain def, so FastAPI runs the whole handler in its threadpool: the two queries and the GCS download are all blocking calls, and the async version of this route (2026-09-18) awaited threadpool hops for the queries while the download itself still ran on the event loop. The async-def plus sync-Session ratchet counted it, rightly.