Serves one document to the holder of a signed link. Anonymous by design - the link carries the authorization, so the caller needs no bearer token - but the link is only half of it: the client and the profile's status scope are both re-checked here, so a disabled client or a profile that moved out of scope stops working immediately rather than at the end of the link's life.