fix(sof-export): re-sign S3 download URLs on each manifest poll (#145)

[mauripunzueta]

Summary

Closes #145.

⚠️ Stacked on #180. Base branch is fix/144-sof-export-cleanup-cancelled, so this PR's diff shows only the #145 changes. GitHub will auto-retarget the base to main once #180 merges. Review/merge #180 first.

For S3-backed SoF exports ($viewdefinition-export / $sqlquery-export), pre-signed GET URLs were generated once at shard-write time and baked into CompletedFile.url. Every later status poll re-served those same URLs, so the presign TTL counted down from write time, not completion — a client re-polling the manifest hours in could receive URLs about to expire (or already expired, under a shorter configured TTL). The spec requires output.location URLs to be valid for ≥24h after completion.

What changed

• CompletedFile stores the shard's filename, not a baked URL.
• ExportSink::write_shard returns the filename; new ExportSink::download_url(job_id, filename) resolves it to a public URL:
  • FilesystemSink / InMemorySink → stable {base}/export/{job_id}/{filename} route (unchanged behavior).
  • S3Sink → a freshly pre-signed GET URL; the presign moves out of the write path into download_url. Presigning is a local signature computation (no network round trip), so re-signing per poll is cheap.
• ExportJobController::download_url (tenant-gated, mirrors read_shard). The result handler re-resolves every shard's URL on each poll, so each handout carries a full TTL window. A resolution failure surfaces as 500 rather than a manifest with an empty location.
• build_completion_manifest now takes pre-resolved (view_name, location) pairs.

Notes / deliberate choices

• Expires header stays tied to the result-retention window (24h, now aligned with the output-retention reaper from fix(sof-export): clean up partial results on cancel, plus a TTL reaper (#144) #180), not to a single pre-signature's lifetime — re-polling always yields a fresh URL. Documented inline.
• STS / temporary credentials can cap a pre-signed URL's effective lifetime below the requested TTL; noted on S3Sink::download_url for operators.

Testing

• New unit tests: in_memory_sink_writes_filename_and_resolves_url, controller_download_url_is_fresh_and_tenant_gated (proves per-poll re-resolution returns distinct URLs + tenant gating).
• helios-rest lib suite (283) and sof_export integration suite (44) pass; FS-sink manifest URLs unchanged. cargo fmt clean; cargo clippy --features s3 --all-targets -D warnings clean.

🤖 Generated with Claude Code

[claude]

Code review

No issues found. Checked for bugs and CLAUDE.md compliance.