Download a field signature image

Streams a filled signature or initials image through this API. The response uses Cache-Control: private, no-store and never exposes a storage key or presigned R2 URL. The credential and workspace relationship are checked on every request. Missing, unfilled, non-image, and cross-workspace fields all answer 404. A single byte range is supported; malformed or multipart ranges answer 416.