feat: add PresignURL method for existing objects (#95)

## Summary

Add `PresignURL(ctx, key)` method to generate presigned download URLs for existing S3 objects (15 min expiry). Needed by document-service to serve document preview/download links.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Reviewed-on: #95

s3.go

@@ -92,6 +92,19 @@ func (s *S3) storeWithDirectUpload(path string, content io.Reader, contentType s
 	return req.URL, nil
 }
 
+// PresignURL generates a presigned download URL for an existing object.
+// The URL is valid for 15 minutes.
+func (s *S3) PresignURL(ctx context.Context, key string) (string, error) {
+	req, err := s.presigner.PresignGetObject(ctx, &s3.GetObjectInput{
+		Bucket: aws.String(s.bucket),
+		Key:    aws.String(key),
+	}, s3.WithPresignExpires(15*time.Minute))
+	if err != nil {
+		return "", err
+	}
+	return req.URL, nil
+}
+
 // New creates a new S3 storage instance using the upload manager
 // This loads AWS config from the default locations and is suitable for most use cases
 func New(bucket string) (*S3, error) {