feat: return signed media URLs with published outputs

app/services/media_service.py

@@ -19,6 +19,7 @@ from app.services.whisper_service import WhisperService
 from app.services.ytdlp_service import YTDLPService
 from app.security.assets import CanonicalAssetService
 from app.security.context import auth_context
+from app.services.media_url_signer import MediaURLSigner
 
 logger = get_logger(__name__)
 Operation = Callable[
@@ -164,6 +165,7 @@ class MediaProcessor:
     ) -> SuccessResponse:
         """Publish a result and build the shared structured success response."""
         download_url: str | None = None
+        signed_url: str | None = None
         output_size = 0
         canonical_asset_id: str | None = None
         if result.path is not None:
@@ -173,6 +175,7 @@ class MediaProcessor:
             output_size = published.stat().st_size
             base_url = self.settings.base_url.rstrip("/")
             download_url = f"{base_url}/v1/media/{resolved.request_id}/{published.name}"
+            signed_url = MediaURLSigner(self.settings).sign(resolved.request_id, published.name)
             # Outputs are registered by the pipeline, never claimed later by
             # a user-supplied path. Anonymous deployments retain legacy media
             # behavior but cannot use the social ownership boundary.
@@ -194,6 +197,7 @@ class MediaProcessor:
             "inputs": probe_metadata,
             "output_size": output_size,
             **({"asset_id": canonical_asset_id} if canonical_asset_id else {}),
+            **({"signed_url": signed_url} if signed_url else {}),
             **(extra_metadata or {}),
         }
         logger.info(