Proxy download for a generated tech pack, adding a friendly filename.

This endpoint:

• Verifies the job belongs to the current user (admins bypass ownership)
• Deducts 1 credit and records the download (skipped on re-downloads)
• Fetches the file from Backblaze B2 via the stored result_url
• Returns the file with Content-Disposition set to "{ItemName}.xlsx"

format defaults to "pdf" to match every existing caller (none send a format today, and the file served here has always been the xlsx, not a PDF — that mismatch predates this gate and is not fixed here). Explicit "excel"/"zip" requests are tier-gated; "zip" is not implemented server-side.