feat(hosted-file): implement hash-based download action and flexible auth

- Adds GET /v3/action/hosted_file/hash/{sha256}/download for direct content-addressable storage access.
- Updates V3 authentication dependencies to support 'api_key' in the query parameter (alias 'api_key').
- Implements auth_method: 'api_key' for machine-to-machine requests that provide a valid key but no user/account context.
- Updates GUIDE__V3_FRONTEND_API.md with the new endpoint and auth options.

documentation/GUIDE__V3_FRONTEND_API.md

@@ -94,7 +94,15 @@ V3 uses specialized **"Action"** routes for binary operations to separate proces
 - **Auth Bypass:** Use `?site_key=<auth_key>` to download without an API Key header or JWT (useful for public kiosks).
 - **Testing:** Supports `delay_ms` query parameter.
 
-### C. Deletion & Cleanup Action
+### C. Hash-Based Download (Content-Addressable)
+**Path**: `GET /v3/action/hosted_file/hash/{sha256}/download`
+
+**Features:**
+- **Local Caching:** Ideal for systems like the Events Launcher that cache files locally by hash.
+- **Flexible Auth:** Supports `api_key` in the query parameter (e.g., `?api_key=<key>`) for simple machine-to-machine requests.
+- **Zero DB Lookup:** Resolves the physical path deterministically from the hash, bypassing database latency.
+
+### D. Deletion & Cleanup Action
 **Path**: `DELETE /v3/action/hosted_file/{id}`
 
 | Parameter | Type | Default | Description |