Resolver referencia de archivo

Resolves a durable doc://<universal_id> artifact reference into a freshly minted, short-lived signed download URL. Identity and workspace scope come from the authenticated API token and the resolved workspace context (header x-workspace-id), never from the body.