f868a4e0c7
- Add _parse_range() helper: validates Range header bounds, raises 416 on invalid - Add stream_document_content endpoint with get_regular_user dep (admin → 403) - Access check: owner OR Share.recipient_id; neither → 404 - Bytes fetched via get_object() only — presigned_get_url() never called - Range requests return 206 + Content-Range header - Add pdf_open_mode column to User ORM model (migration 0004 already applied) - Use HTTP_416_RANGE_NOT_SATISFIABLE (non-deprecated constant)