feat(client): add getHiddenFileSignedUrl for ranged streaming

[agviegas]

What

Adds EngineServicesClient.getHiddenFileSignedUrl(hiddenId, expiresIn?).

const { url, expiresAt } = await client.getHiddenFileSignedUrl(hiddenId);
// fetch ranges directly:
const res = await fetch(url, { headers: { Range: "bytes=0-65535" } }); // 206

Why

downloadHiddenFile() streams the whole object. For very large hidden files — e.g. a point cloud's octree.bin that a viewer reads in small [offset, length] slices — downloading the entire file isn't viable. This method returns a short-lived signed URL the browser can fetch directly with native HTTP Range requests, so the renderer pulls only the bytes it needs.

Notes

• Returns { url, expiresAt }. expiresAt is an ISO timestamp; re-call to refresh the URL when it nears/passes expiry. Optional expiresIn (seconds) requests a specific lifetime.
• Read-only; complements the existing downloadHiddenFile() (still the right call for whole small files).

Testing

• tsc --noEmit green.