Get uploaded file. Public uploads are served without auth. Private uploads require auth. With Accept: application/json returns metadata. Otherwise returns 302 redirect to signed URL (for img src).
Authentication via JWT token or API key. JWT: Get from Veryfront dashboard. API Key: Format "vf_
File metadata (when Accept: application/json)