Mint short-lived, header-free download URLs for a user's stored files.

For destinations that fetch a file themselves instead of being handed bytes.
An Airtable attachment field is filled by Airtable's own servers following a
URL, so the ordinary download endpoints - which need this caller's bearer
token - are unreachable from there.

POST because it creates credentials: the response body is a set of live URLs
and must never sit in a cache. Same permission and visibility gate as the
download endpoints, checked HERE so the download path only has to verify a
signature.