Downloads or streams the datastore publication file. Supports both authenticated and anonymous access based on file authentication settings. Supports HTTP Range requests for seeking. Use attachment=true to force download.

Authentication Methods:

1. Stream Token (for restricted users): Use 'Authorization: Bearer {streamToken}' header. Required for users with RestrictedCallRecordDownload role.
2. Standard Auth: Uses existing Auth0/Bearer token from middleware for users without restrictions.

Redirects to SSO login if external SSO is required.