US/EU SaaS: Private File Exports with Object Storage and Signed Download URLs

US/EU SaaS solutions must keep exported files private and enforce authorization in the application before minting short‑lived signed download URLs. The export state machine starts before storage, and a durable URL should not outlive tenant membership or retention decisions. For private thumbnails, tenant and source revision become part of the derivative identity, and authorization checks happen before issuing signed URLs.