Get a presigned download URL for a blob

Returns a time-limited presigned URL pointing directly at the underlying S3-compatible object store. The ttl query parameter (seconds, default 3600) sets the URL’s lifetime. Useful for serving images and other static assets without proxying them through the API server.

Available only when BLOB_BACKEND=s3. Filesystem-backed deployments return 400 — use GET /blobs/{hash} to stream bytes instead.