Download signed contract by signed link

Serves the signed document to whoever holds a valid link. NO auth, deliberately:
the caller is an attachment fetcher that cannot present a bearer token. The
signature IS the authorization - it names one contract request, was minted
only after the permission check, and expires in minutes. Every failure is a
flat 404 so the endpoint cannot be used to probe which contracts exist or
how far along they are.