Add presigned URL support for direct S3 downloads (#48)

- Add ORCHARD_DOWNLOAD_MODE config (presigned, redirect, proxy)
- Add ORCHARD_PRESIGNED_URL_EXPIRY config (default: 3600s)
- Add generate_presigned_url() method to S3Storage
- Modify download endpoint to support ?mode= query parameter
- Add /url endpoint for getting presigned URL without redirect
- Add PresignedUrlResponse schema with URL, expiry, and checksums
- Default download mode is now presigned for better performance

backend/app/schemas.py

@@ -330,6 +330,20 @@ class GlobalSearchResponse(BaseModel):
     counts: Dict[str, int]  # Total counts for each type
 
 
+# Presigned URL response
+class PresignedUrlResponse(BaseModel):
+    """Response containing a presigned URL for direct S3 download"""
+    url: str
+    expires_at: datetime
+    method: str = "GET"
+    artifact_id: str
+    size: int
+    content_type: Optional[str] = None
+    original_name: Optional[str] = None
+    checksum_sha256: Optional[str] = None
+    checksum_md5: Optional[str] = None
+
+
 # Health check
 class HealthResponse(BaseModel):
     status: str