Serve asset downloads via backend instead of redirecting to storage.

The download endpoint now streams object bytes from storage on the same API URL so clients never get redirected to MinIO/internal hosts, while preserving public/private access checks.

Made-with: Cursor

internal/http/handlers.go

@@ -3,6 +3,8 @@ package httpapi
 import (
 	"encoding/json"
 	"errors"
+	"fmt"
+	"io"
 	"net/http"
 	"strings"
 	"time"
@@ -492,10 +494,20 @@ func (a *API) downloadAsset(w http.ResponseWriter, r *http.Request) {
 		return
 	}
 	assetID := r.PathValue("id")
-	url, err := a.service.SignedDownloadURL(user, assetID)
+	reader, contentType, size, err := a.service.OpenAssetDownload(user, assetID)
 	if err != nil {
 		writeErr(w, err)
 		return
 	}
-	http.Redirect(w, r, url, http.StatusFound)
+	defer reader.Close()
+	if contentType != "" {
+		w.Header().Set("Content-Type", contentType)
+	}
+	if size >= 0 {
+		w.Header().Set("Content-Length", fmt.Sprintf("%d", size))
+	}
+	if _, err := io.Copy(w, reader); err != nil {
+		// Response stream may be interrupted by client disconnects; ignore write errors here.
+		return
+	}
 }