feat: add PresignURL method for existing objects

Generate presigned download URLs for objects already stored in S3,
valid for 15 minutes. Needed by document-service to serve document
download links.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

s3.go

@@ -92,6 +92,19 @@ func (s *S3) storeWithDirectUpload(path string, content io.Reader, contentType s
 	return req.URL, nil
 }
 
+// PresignURL generates a presigned download URL for an existing object.
+// The URL is valid for 15 minutes.
+func (s *S3) PresignURL(ctx context.Context, key string) (string, error) {
+	req, err := s.presigner.PresignGetObject(ctx, &s3.GetObjectInput{
+		Bucket: aws.String(s.bucket),
+		Key:    aws.String(key),
+	}, s3.WithPresignExpires(15*time.Minute))
+	if err != nil {
+		return "", err
+	}
+	return req.URL, nil
+}
+
 // New creates a new S3 storage instance using the upload manager
 // This loads AWS config from the default locations and is suitable for most use cases
 func New(bucket string) (*S3, error) {