Fetch a public file (unauthenticated)

Stable public URL for files with visibility=public. 302s to a short-lived presigned S3 URL; private, expired, deleted, or unknown files are an indistinguishable 404. Egress is billed to the file owner, and is a 404 as well when the owner's balance cannot cover it.