Store downloadable files in private storage

[catherineluse]

Summary

• add an explicit private-download upload target backed by GCS_PRIVATE_DOWNLOAD_BUCKET_NAME
• sign short-lived read URLs for both scan plugins and approved user downloads
• keep signed scanner credentials out of persisted PluginRun payloads
• preserve URL-backed legacy downloads
• add a dry-run-first migration command and deployment runbook for existing storage-backed files

Deployment order

1. Create a non-public GCS bucket and configure GCS_PRIVATE_DOWNLOAD_BUCKET_NAME.
2. Deploy this backend change.
3. Dry-run and apply pnpm run migrate:private-downloads -- --apply during a maintenance window.
4. Merge/deploy the companion frontend PR that requests the private upload target.

Verification

• pnpm run codegen
• pnpm exec tsc --noEmit --pretty false
• focused ESLint
• 31 focused unit tests covering bucket routing, fail-closed configuration, signed plugin access, credential persistence, legacy URLs, and pre-download behavior

[codecov]

Codecov Report

❌ Patch coverage is 90.00000% with 10 lines in your changes missing coverage. Please review.

Files with missing lines	Patch %	Lines
...ustomResolvers/mutations/createSignedStorageURL.ts	75.86%	7 Missing ⚠️
services/downloadStorage.ts	94.73%	2 Missing ⚠️
services/plugin/downloadTrigger.ts	96.29%	0 Missing and 1 partial ⚠️

📢 Thoughts on this report? Let us know!