Mint a short-lived download URL for the company's signup document.

This one is not a Z_OnboardingUploads row — it belongs to the company's Z_CompanyRegistrations record, from the era when the public signup form demanded a certidão. It gets its own endpoint rather than an id on the generic upload route because it has no upload id to be scoped by.

The S3 key is never accepted from the caller: it is re-resolved server-side from the questionnaire, so there is no identifier to tamper with. Same 300s/inline=False treatment as the questionnaire's own uploads (same bucket, same "client-supplied file, download it, never render it on the bucket origin" reasoning) — deliberately NOT the 1-hour inline URL the registration screen mints.