willchen96 stops the download system from borrowing the database's master key

When the system hands out a secure link to download a document, it signs that link with a secret key so it can't be forged. Until now, if the dedicated key for that job wasn't configured, the system silently fell back to using the master credential for its underlying database - the single most sensitive secret in the stack.

This change ends that. Download links now require their own purpose-built signing key, and if it's missing, the system fails loudly and names exactly what's not set instead of quietly reaching for the master credential. The practical payoff is separation: the team can rotate, scope, or revoke the download key without any risk of disturbing the database credential, and misconfigurations get caught at setup rather than becoming a silent security gap.