Create signed document download link

Mints a short-lived, header-free URL for the completed (signed) PDF, for
destinations that fetch a file themselves instead of being handed bytes:
an external attachment store follows the URL from its own servers, so the
ordinary download endpoint, which needs this caller's bearer token, is
unreachable from there.

POST because it creates a credential: the response is a live URL and must
never sit in a cache. Returns 404 if the request does not exist or belongs
to a different client, and 409 if it has not reached COMPLETED status yet.