Returns a short-lived signed URL (GET on this same path) that downloads the requested time range as a single MP4 without an Authorization header, for browser-native downloads. Authorization is checked here; the URL is a capability scoped to this stream and range until it expires.