fix(evidence): proxy download + fix Jira attachment signature

Evidence download:
- Replace presigned MinIO URLs with backend proxy endpoint
  GET /api/v1/evidence/{id}/file streams the file through the backend
  so MinIO never needs to be publicly accessible from browsers
- Add download_file() helper to storage.py (internal boto3 get_object)
- download_url in EvidenceOut now points to the proxy endpoint

Jira attachment:
- Fix add_attachment call: use add_attachment_object(issue_key, BytesIO)
  instead of add_attachment(issue_key, filename=..., content=...) which
  had wrong keyword args for the installed atlassian-python-api version

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

backend/app/storage.py

@@ -70,6 +70,12 @@ def upload_file(content: bytes, key: str) -> str:
     return key
 
 
+def download_file(key: str) -> bytes:
+    """Download *key* from the evidence bucket and return its raw bytes."""
+    response = _client.get_object(Bucket=settings.MINIO_BUCKET, Key=key)
+    return response["Body"].read()
+
+
 def get_presigned_url(key: str, expiration: int = 3600) -> str:
     """Return a presigned GET URL for *key* valid for *expiration* seconds.