Get signed download URL for a document.

Authentication: JWT required RLS: User must have access via family membership or document ownership

Returns signed URL for direct download. Blocks quarantined files.

playback opts into the normalised MP4 for a transcoded video. It is opt-in because this is also the file download endpoint - "save to disk" on web, clinic and mobile all resolve here, and those want the bytes the parent actually uploaded, under the name and MIME they uploaded them with. Handing a re-encode to a clinician exporting a record would be silent data substitution, so only the viewers that want to play the file ask for it.