Summary

• Improves the existing inline file-view endpoint for images, video, audio, and PDFs.
• Reuses the existing FileService.loadAsResource() flow.
• Adds inline content disposition, MIME type, ETag, and last-modified headers.
• Supports HTTP byte-range requests for media seeking and partial PDF loading.
• Encodes filenames safely in UTF-8, including spaces and non-ASCII characters.
• Documents viewer integration and existing file-action endpoints.
• Adds controller coverage for real resource loading, traversal and symlink escapes, MIME fallback, full/open/suffix/unsatisfiable ranges, and encoded filenames.

Linked issue

Part of #98

Frontend authentication integration is tracked in Vault-Web/vault-web#281.

How to test

1. Run the test suite:

   cd backend
   ./mvnw test

2. Request a supported file:

   GET /api/files/view?path=video.mp4
   Authorization: Bearer <token>

3. Verify the response includes the correct Content-Type, Content-Disposition: inline, ETag, and Last-Modified headers.

4. Send full, open, suffix, and unsatisfiable byte-range requests. Verify valid ranges return 206 Partial Content with Content-Range, while an out-of-bounds range returns 416.

5. Verify unknown MIME types return application/octet-stream.

6. Verify traversal and symlink paths outside the authenticated user root are rejected.

Notes / Risk

• No database migrations or feature flags are required.
• Existing download, rename, move, delete, and folder-listing APIs are unchanged.
• The frontend viewer shell and sidebar still need to be implemented in Vault Web.
• Native media elements cannot attach an arbitrary bearer-token header. The authenticated same-origin route is tracked in Add authenticated same-origin proxy for workspace file previews vault-web#281.