Streams a single MP4 (Content-Disposition: attachment) for the signed time range. Authenticated by the sig query parameter minted by the POST method on this path — no Authorization header — so browser navigations and download managers work directly.