Download blob binary

Streams the bytes for a previously-uploaded blob, identified by its sha256:<hex> hash. Response is application/octet-stream with the raw bytes. Tenant-scoped — a hash uploaded in tenant A is not visible to tenant B; cross-tenant probes return 404.

For S3-backed deployments serving images and other static assets, prefer GET /blobs/{hash}/url (presigned URL) so the browser fetches directly from the object store and the API isn’t a proxy.