Create a pre-signed download URL for an existing file.

Flow:

1. Call this endpoint with the file's key — as returned by /storage/upload, or as found on entities (e.g. the proof documents of a tour stop).
2. Send a GET request to the returned url to fetch the file bytes directly from cloud storage. The URL is valid for 15 minutes; request a fresh one when it expires.

Files can only be read by the tenant that owns them. Keys whose first path segment is undefined are not valid tenant keys.