Stream asset content (supports HTTP Range requests)

Returns the binary content of a media asset. A signed-in caller must own the asset; a signed token authorizes the one asset it names. Supports Range requests for partial content (206) and returns 416 when the requested range is not satisfiable. Responses carry the stored file's ETag; a matching If-None-Match answers 304 without a body, and a Range whose If-Range does not match gets the whole file. Every response carries X-Content-Type-Options: nosniff and a sandboxing CSP; types outside the image/video/audio allow-list are sent as attachments.