Serve asset downloads via backend instead of redirecting to storage.

The download endpoint now streams object bytes from storage on the same API URL so clients never get redirected to MinIO/internal hosts, while preserving public/private access checks.

Made-with: Cursor

internal/app/service.go

@@ -39,6 +39,7 @@ type Config struct {
 type AssetURLSigner interface {
 	SignedGetObjectURL(ctx context.Context, objectKey string, expiry time.Duration) (string, error)
 	PutObject(ctx context.Context, objectKey, contentType string, body io.Reader, size int64) error
+	GetObject(ctx context.Context, objectKey string) (io.ReadCloser, string, int64, error)
 }
 
 type Service struct {
@@ -551,3 +552,17 @@ func (s *Service) SignedDownloadURL(requesterKey, assetID string) (string, error
 	}
 	return url, nil
 }
+
+func (s *Service) OpenAssetDownload(requesterKey, assetID string) (io.ReadCloser, string, int64, error) {
+	if s.assetSigner == nil {
+		return nil, "", 0, ErrStorageNotConfigured
+	}
+	asset, err := s.store.GetAsset(assetID)
+	if err != nil {
+		return nil, "", 0, ErrAssetMiss
+	}
+	if asset.OwnerKey != requesterKey && !asset.IsPublic {
+		return nil, "", 0, ErrForbidden
+	}
+	return s.assetSigner.GetObject(context.Background(), asset.ObjectKey)
+}