Improve API export signed URL evidence

[DENGXUELIN]

Closes #1750.

Summary

• add bulk export and signed download URL evidence gates to api-security
• cover create/status/download/cleanup authorization, signed URL lifecycle, storage isolation, export limits, retention, and auditability
• add vulnerable and benign fixtures for cross-tenant export signed URL abuse versus scoped export controls

Validation

• git diff --check origin/main...HEAD
• Markdown fence balance check
• added-line ASCII check
• content marker check for API-EXPORT-* findings and fixtures
• git merge-tree --write-tree origin/main HEAD

Bounty

Requested tier: Improver Moderate, USD 100 if accepted.