Download an export's artefact
Stream the file an export produced.
There are no signed download URLs anywhere in this platform, so this is how the artefact is fetched: the request is authenticated and authorised like any other, and the bytes are streamed through it. Authorisation is therefore checked when the file is fetched rather than when a link was minted, so a grant withdrawn after the export was produced stops the download.
The check is stricter than reading the record. Every subject the export covered has to be one the caller may view, because the artefact contains all of them and cannot be served in part.
Each fetch is recorded. Retention answers what was issued; the download record answers who took it.
An export that is still pending, or that failed, returns a conflict rather than an empty file.
Served by a custom handler rather than a generated one, because it returns a file rather than a JSON:API document.