Use an authenticated fetch for credentialed browser downloads
When an admin-only file download requires a bearer credential that a normal attachment link will not attach, use an authenticated fetch, convert the successful response to a Blob, and trigger the download through a temporary object URL. Validate that the request URL remains same-…