fix(auth): bind detached downloads to account

[veryCrunchy]

What changed

• validate Android and desktop detached-download targets against the signed-in account origin and base path before attaching credentials
• follow only bounded account-safe GET redirects through the authenticated request policy from PR fix(auth): bind login and DAV requests to account #428
• keep coroutine cancellation bound to the active request across redirect hops
• retain custom request headers, byte limits, ETag validation, and network diagnostics on the final response

Validation

Passed on the dedicated Linux build host with the same production and test blobs now in this branch:

• :ui:desktopTest --tests dev.obiente.nextcloudnative.app.DesktopDetachedDownloadTest
• :androidApp:testDebugUnitTest --tests dev.obiente.nextcloudnative.AndroidDetachedDownloadTransportTest
• :androidApp:assembleDebug

Passed again on the exact rewritten branch:

• bash tools/check-kotlin-architecture.sh
• bash tools/check-repository.sh
• git diff --check

Compatibility and risk

• Android and desktop detached file, attachment, and historical-version downloads only
• depends on PR fix(auth): bind login and DAV requests to account #428 and is one commit above its exact head
• tests use synthetic MockWebServer origins; no live server was used
• broader authenticated service calls and media playback transports remain outside this slice

Visual changes

Not applicable.

Advances #106

[obiente-cloud]

Obiente preview

NC Native · 4a38f5a8ec3b · Removed

View preview status

View in Obiente

_{Obiente updates this comment as the preview changes.}

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-09-04T00:07:10.315739Z	4a38f5a	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.