Tenant Object Storage: Create Temporary Download Links for Generated Catalog Images

To secure tenant files and AI-generated images, store objects privately and use short-lived signed URLs for uploads and downloads. The application database must handle authorization and retention deadlines, as object storage cannot manage tenancy or specific deletion dates. This architecture separates byte storage from access control, ensuring the database decides who can export images or when leases expire. This design prevents the application server from relaying every byte while maintaining strict security and ownership boundaries.