fix: harden file download responses

[MINBBBIGcode]

Refs #5.

Summary:

• Harden shared file download responses.
• Escape filenames in Content-Disposition headers.
• Add content-length coverage, file_id coverage, and nested binary path coverage.

Validation:

• bun test
• bun run format:check
• npx tsc --noEmit
• git diff --check