Require invited login and private downloads for the company pilot

Assistant: codex
Assistant-Model: gpt-6-astra
Assistant-Session: 01a07ff8-19d0-7820-b4d0-1353833cb7fc

vergabe_teilnahme/apps/dokumente/downloads.py

@@ -0,0 +1,23 @@
+from pathlib import Path
+
+from django.conf import settings
+from django.http import FileResponse, Http404
+from django.views.decorators.http import require_safe
+
+
+@require_safe
+def protected_media(request, path):
+    """Download company uploads through the application authentication gate.
+
+    The invited pilot has one company per deployment. MEDIA_ROOT must contain
+    uploads only; operational databases and credentials live outside this root.
+    """
+    root = Path(settings.MEDIA_ROOT).resolve()
+    try:
+        target = (root / path).resolve()
+        if not target.is_relative_to(root) or not target.is_file():
+            raise Http404
+        file = target.open('rb')
+    except (OSError, RuntimeError, ValueError) as exc:
+        raise Http404 from exc
+    return FileResponse(file, as_attachment=True, filename=target.name)