Asset Content
media
Asset Content
Stream an asset's bytes from the active backend (RLS ensures it's the caller's).
Auth: normally the session cookie (principal). A valid signed `?token=` also authorises — so
external download managers / wget (which don't carry the cookie) can fetch via a minted link
(see POST /{id}/download-link). The token binds {asset, tenant} and expires.
Honours HTTP Range so the browser <video> can SEEK: a `Range` request gets a 206 with the
requested slice + `Content-Range`; otherwise a 200 with `Accept-Ranges: bytes` advertised so
the player knows it MAY seek. Without this, <video> can only play straight through from 0.