Stream a job's original source video for the live-analysis preview and the clip editor's source monitor.

Uploaded sources are blob URLs in the browser and don't survive a reload, so the recovered session points the preview here instead.

This one endpoint serves the untouched original, which for a URL job is the file we downloaded. Left open it is a public downloader wearing a UUID, so a cloud job with an owner needs either a signed URL from /api/source-url or a bearer token on the request. Self-host and ownerless BYOK jobs are unchanged: there is no owner to check and no secret to sign with.