Support time-based signed download URLs

[sterlingkoch]

Problem Description

Enterprise download URLs currently embed the Image Factory username and password in plaintext. Per the July 15 planning meeting, these are being replaced with time-based signed URLs (see siderolabs/image-factory#498). This ticket covers the Omni side of that change. Part of TEL September readiness.

Where the signed URL gets generated is an open question for engineering: (I think) Omni holds the actual credential while the factory only stores hashes (flagged by Andrey at the end of the meeting), so signing may need to happen Omni-side, or Omni may need to request a fresh signed URL from the factory when the download dialog renders. Either way, the UI requirements below apply.

See siderolabs/image-factory#498 for more context

Solution

Regardless of where signing happens, the Omni UI needs to:

• Clearly state the link's validity window ("valid for 1 hour" — exact TTL TBD in image-factory#498).
• Handle expiry gracefully: a way to regenerate/re-fetch a fresh link on demand, not a silently dead link.
• Keep the URL copy/curl-able from any machine within the validity window — downloading via a bastion host into a restricted environment is the primary use case these links must support, and the reason plain authenticated-session links were rejected.

Alternative Solutions

No response

Notes

Related: #3137 (hide PXE boot for enterprise, which is the one URL type that can't use this scheme).

[sterlingkoch]

Design guidance...

Where this lives
The schematic output screen of the install-media wizard (the screen listing ISO / disk images / installer image / extra assets). Signed URLs replace the embedded-credential URLs in place — same layout, same copy buttons.

One validity message for the whole screen, not per link.
All links on this screen are minted together at render, so they share one expiry. One line above the asset list:

"These download links are valid for about 1 hour — until 3:42 PM (UTC−6)."

(Exact TTL still TBD in image-factory#498).

Expired state: screen-level, not per-link. When expiry passes while the dialog is open, flip the whole screen with a client-side timer icon rather than letting someone copy a dead link:

Message: "These download links have expired."
One action: "Generate fresh links" button — re-requests tokens and re-renders the same screen.
Copy buttons disabled in the expired state.

Something like this:

Schematic ready   412ef446…
──────────────────────────────────────────────
ⓘ Links valid for ~1 hour — until 3:42 PM (UTC−6).

ISO          https://factory.siderolabs.com/image/…?token=…   [copy]
Disk (raw)   https://factory.siderolabs.com/image/…?token=…   [copy]
…
──────────────────────────────────────────────
⚠ These download links have expired.
  [ Generate fresh links ]        (copy buttons disabled)

PXE: the PXE row disappears for enterprise per #3137, so it needs no expired-state treatment.

Happy to do a Figma pass on the two states if that would help, but I'm guessing the above is enough to go on.