Sign the proof file of one certificate

A time-limited, read-only download URL for the proof file of one certificate the caller's company can see: the certificate belongs to a company in the caller's network, and a DRAFT is visible only to its creator. Takes a claim id, never a file url: the object key is resolved server-side from the claim, so the caller cannot name an arbitrary file. A claim outside the caller's network answers 404 claim_not_found whether or not it exists; a visible claim that carries no file answers 404 claim_has_no_file. The list and detail endpoints already embed the same signed URL in fileUrl; this route is for a caller that only holds the id. Replaces GET /api-service/v3/files/:fileUrl, which signed any private-bucket key it was handed and was removed in DELTA-2422.