download: no conditional-request support; download-auth token not usable on the typed download path

[goanpeca]

Area: download (src/download/single.ts, src/types/download.ts)

DownloadCommonOptions has no conditional fields (If-Modified-Since, If-None-Match/ETag, If-Range), and downloadByName always uses the session auth token. A scoped download-authorization token can only be used via the hand-built presignGetObjectUrl, not through the typed download path.

Impact: no HTTP caching/304 revalidation; scoped download tokens are second-class.

Expected: add conditional-request options and a way to pass a download-auth token to downloadByName.

Acceptance criteria:

• conditional headers supported; 304 surfaced
• downloadByName accepts a scoped download-auth token
• regression tests

Source: post-0.1.0 audit.