Stream one complete original file

Use the private URL returned by the download operation. Toma checks the action-bound token and current access, then verifies bytes and rechecks access during streaming. Never redirects to an irrevocable S3 download URL. Content-Disposition carries the original logical filename; no-store and nosniff are enforced.