Signed API export download URLs

For GiveCampus integrations and API.

An API export can return a separate signed S3 download URL. The upload services generate response download URLs with a 900-second expiry. Preserve the complete returned URL, including its query string, and fetch it promptly. An S3 SignatureDoesNotMatch error is not by itself proof that the GiveCampus API key is invalid. If one client succeeds and another fails, compare their actual download requests for URL/query transformations and authentication differences; the exact requests are needed to diagnose the incident. Do not publish signed URLs or credentials in troubleshooting examples.