Require login to export files; allow downloading the original too

?download=... on GET /api/gpx/file now requires login, same as
upload/move/delete/create-folder -- plain viewing (no ?download)
stays public. Added ?download=original alongside the existing
GeoJSON export, serving the untouched, as-uploaded file directly via
send_file -- the file name link still downloads GeoJSON, a new
button next to delete downloads the original.

Since both are real <a href> links (so right-click/middle-click still
work), a logged-out click can't just be left as a plain navigation --
it would land on a raw JSON error page instead of being sent to log
in. _download (gpx.js) fetches instead, reuses the existing
redirectIfUnauthorized 401 check, and only then turns the response
into a blob and clicks a throwaway <a download> to trigger the save.

Verified in a real browser: an anonymous click on either download
correctly redirects through /login to the real OAuth login page
instead of showing raw JSON.

test/test_app.rb

@@ -76,7 +76,7 @@ class AppTest < Minitest::Test
     content = File.read(fixture_path("sample.gpx"))
     post_file("/api/gpx", filename: "ride.gpx", content: content, env: logged_in_env)
 
-    response = request.get("/api/gpx/file/ride.gpx?download=1")
+    response = request.get("/api/gpx/file/ride.gpx?download=geojson", **logged_in_env)
     assert_equal 200, response.status
     assert_includes response.headers["Content-Disposition"], 'filename="ride.gpx.geojson"'
   end
@@ -85,11 +85,31 @@ class AppTest < Minitest::Test
     content = '{"type":"FeatureCollection","features":[]}'
     post_file("/api/gpx", filename: "spots.geojson", content: content, env: logged_in_env)
 
-    response = request.get("/api/gpx/file/spots.geojson?download=1")
+    response = request.get("/api/gpx/file/spots.geojson?download=geojson", **logged_in_env)
     assert_equal 200, response.status
     assert_includes response.headers["Content-Disposition"], 'filename="spots.geojson"'
   end
 
+  def test_download_of_the_original_file_serves_it_unconverted
+    content = File.read(fixture_path("sample.gpx"))
+    post_file("/api/gpx", filename: "ride.gpx", content: content, env: logged_in_env)
+
+    response = request.get("/api/gpx/file/ride.gpx?download=original", **logged_in_env)
+    assert_equal 200, response.status
+    assert_includes response.headers["Content-Disposition"], 'filename="ride.gpx"'
+    assert_equal content, response.body
+  end
+
+  def test_download_requires_login
+    content = File.read(fixture_path("sample.gpx"))
+    post_file("/api/gpx", filename: "ride.gpx", content: content, env: logged_in_env)
+
+    assert_equal 401, request.get("/api/gpx/file/ride.gpx?download=geojson").status
+    assert_equal 401, request.get("/api/gpx/file/ride.gpx?download=original").status
+    # Plain viewing (no ?download) stays open to anyone.
+    assert_equal 200, request.get("/api/gpx/file/ride.gpx").status
+  end
+
   def test_unparseable_gpx_returns_422
     post_file("/api/gpx", filename: "bad.gpx", content: "<gpx><trk unclosed>", env: logged_in_env)