## Why

Run can upload artifacts to the platform transfer channel, but operators and plugin pages still need a safe way to discover, download, and hand off artifact references in the browser. Artifact download must remain platform-mediated so browser code never receives raw storage backend credentials, raw host paths, or direct run sockets.

## What Changes

- Add platform artifact download/read APIs that authorize artifact access and stream or return bounded content through platform-owned routes.
- Add browser-facing artifact metadata, download URL/token, chunk read, and transfer progress contracts without exposing storage internals.
- Add frontend API client and UI behavior for artifact download from server/job/plugin contexts.
- Integrate plugin bridge artifact actions with browser-safe artifact references.
- Add platform and frontend tests plus browser walkthrough for download, access denial, resume/progress, and no-secret rendering.

## Capabilities

### New Capabilities

- `artifact-download-and-browser-transfer`: Browser-safe platform-mediated artifact discovery, download, and plugin bridge transfer references.

### Modified Capabilities

- Builds on `artifact-transfer-channel`, plugin bridge contracts, and server/job workflows without changing run upload semantics.

## Impact

- Affects `platform/` artifact DTOs, validators, services, APIs, and docs.
- Affects `platform_web/` API contracts, artifact UI/download behavior, plugin bridge host integration, and tests.
- May affect `plugins/` SDK artifact reference helpers/tests.
- Does not add external object storage, presigned raw backend URLs, direct plugin-to-run access, billing, cloud host sales, or unrelated SaaS marketplace features.