Create Download Token
Mint a short-lived token for a browser-native download.
The browser writes the response straight to disk only when it
issues the request itself, and such a request carries no custom
header — hence a credential in the URL. Fetching with X-User-ID
instead works but holds the whole file in the tab.
Minting depends on the normal identity, so whatever replaces
X-User-ID guards this too.
The session is resolved here only to fail early: the download is a browser navigation, so an error there surfaces as a raw error page rather than something the UI can show.
Headers
Caller's user ID. Temporary header-based identity; will be replaced by JWT auth.
Query Parameters
The path the token will authorize.