Let owners view a vault file from the Files list and the Edit form

Problem/Motivation

An owner can edit or delete a vault file but has no way to view its contents: only records have a View action, files do not, and the Edit form shows the filename as plain text. There is a consumer-facing raw endpoint (pdv_server_api), but nothing owner-session-facing.

Proposed resolution

• Add an owner-only route pdv.item.download (/vault/item/{pdv_item}/download): it decrypts the file and serves the bytes with the stored MIME. Inline for a safe allowlist (images, PDF, plain text) so they render in the browser; attachment for everything else, so an uploaded HTML/SVG cannot run script in the owner session. X-Content-Type-Options: nosniff and no-store.
• Add a View action to the Files list and link the Edit form filename to the same route (opens in a new tab).
• A locked vault is handled by the locked-vault redirect subscriber (#3594933): the View link redirects to unlock and returns to the file afterward, rather than erroring.

Remaining tasks

• Review.
• Merge.