fix(auth): bind detached downloads to account - #432

What changed

• validate Android and desktop detached-download targets against the signed-in account origin and base path before attaching credentials
• follow only bounded account-safe GET redirects through the authenticated request policy from PR fix(auth): bind login and DAV requests to account #428
• keep coroutine cancellation bound to the active request across redirect hops
• retain custom request headers, byte limits, ETag validation, and network diagnostics on the final response

Validation

Passed on the dedicated Linux build host with the same production and test blobs now in this branch:

• :ui:desktopTest --tests dev.obiente.nextcloudnative.app.DesktopDetachedDownloadTest
• :androidApp:testDebugUnitTest --tests dev.obiente.nextcloudnative.AndroidDetachedDownloadTransportTest
• :androidApp:assembleDebug

Passed again on the exact rewritten branch:

• bash tools/check-kotlin-architecture.sh
• bash tools/check-repository.sh
• git diff --check

Compatibility and risk

• Android and desktop detached file, attachment, and historical-version downloads only
• depends on PR fix(auth): bind login and DAV requests to account #428 and is one commit above its exact head
• tests use synthetic MockWebServer origins; no live server was used
• broader authenticated service calls and media playback transports remain outside this slice

Visual changes

Not applicable.

Advances #106