Serve one stored file to whoever holds a valid signed link. NO auth.

Deliberately unauthenticated: the caller is Airtable's fetcher, which cannot
present a bearer token. The signature IS the authorization - it names one
stored file, was minted only after the full permission and visibility check,
and expires in minutes. Every failure is a flat 404 so the endpoint cannot be
used to probe which file ids exist.