presign get url

Creates a temporary URL that lets anyone read one private object, without proxying it through this server. Not available in a simulation : the URL is a real credential.

Builds a time-limited URL granting anonymous READ of `bucket`/`key`. Makes NO network call : it is pure signing, so it works against an endpoint that is down. It is nonetheless SUPPRESSED in a simulation: the URL is a bearer credential against the live bucket that outlives the run, and simulating is a lower bar than a production run. The signature covers the method and the key, so the URL cannot be used to write and cannot be pointed at another object. Treat the result as a BEARER CREDENTIAL: anyone who holds it has that read access until it expires, so keep `expires_in` short. Default 900s, maximum 604800s (7 days, the SigV4 ceiling) : a larger value is REFUSED rather than clamped, because silently handing back a URL that dies in a week is worse than an error. `download_filename` sets a Content-Disposition so the browser saves under a friendly name; `content_type` overrides the served type. success=false with NO_CONNECTION, MISSING_BUCKET, MISSING_KEY, or an expiry outside the allowed range.