Download an object from the bucket

Generates a short-lived download for a single object in the bucket, backing the per-row "Download" action in the object browser. The caller names the object key; the backend resolves the object's latest version and returns a time-limited download URL together with the object's size and content type. The bucket and the object are not mutated. Validation: bucketId must reference an existing, non-deleted bucket in the scope (unknown → 404 NOT_FOUND); key is required, must be a non-empty object key that exists in the bucket and must reference a file, not a folder prefix (missing/empty → 422 VALIDATION_FAILED, unknown key → 404 NOT_FOUND). An object uploaded since the last refresh is looked up in the container, so it is exportable at once; caller must hold reader-or-higher RBAC on the scope, otherwise 403 FORBIDDEN. Async & state: Synchronous — returns 200 with the BucketExportResult containing the time-limited downloadUrl. No bucket state changes and no SSE frames are emitted; the download itself is performed by the browser against the returned URL until expiresAt. Errors: 401 unauthenticated; 403 caller lacks read access to the scope or the object; 404 unknown scopeId, bucketId or object key; 409 CONFLICT details.reason=project_suspended the project's Temp-URL keys are withdrawn while it is suspended; 422 missing or malformed key (details.reason=object_key_invalid, details.rule one of empty|too_long|control_char|folder|edge_unreachable -- the key is the exact object name, never trimmed); 429 download-link issuance rate limit exceeded; 500 unexpected backend failure. Signing key: the URL is signed with the account's Temp-URL-Key (slot 1). An existing slot-1 key -- including one the customer set -- is reused unchanged; only an account without one gets a key written, once. Slot 2 and container keys are never written. Idempotency/Concurrency: This operation does not use Idempotency-Key; it may be omitted and a sent one is ignored. Every call signs a new download URL with a fresh expiresAt; an earlier URL keeps working until its own expiry. The returned URL is the only place the signed token appears — it is never readable from any subsequent GET.