Admin: Build a safe raw-artifact viewer with exact-locator navigation and download

[gekichumai-admin]

Phase / step: Phase 4 — Provenance / Step 5
Parent: #301
Depends on: #335, #331

Context and goal

Administrators need to inspect retained source evidence at the exact location supporting a chart field. Raw bytes live in a private Cloudflare R2 archive and must only be reached through authorized backend responses; the browser must never receive storage credentials.

Scope and implementation notes

• Add a read-only artifact route whose URL carries only the opaque evidence reference plus chart/revision/field navigation context. Fetch the artifact identity and exact validated locator from backend metadata; never accept a browser-authored object key, bucket, path, or locator as authority.
• Render syntax-aware content for supported textual formats and highlight/scroll to the exact locator. Use incremental or virtualized rendering so large retained artifacts do not freeze the page.
• Show artifact metadata separately from content: media type, size, content hash, capture time, source identity, retention/availability state, and revision linkage.
• Fetch content and downloads only from authenticated admin API endpoints. Never construct direct object-store URLs or expose signing credentials in client configuration.
• Provide an explicit download action with filename and size confirmation. Treat inline rendering and download as separate capabilities returned by the server.
• Keep at most the documented number of preview/download streams active in one client, cancel abandoned range requests on navigation, and present backend size/concurrency/egress-limit responses without automatic retry.
• Handle expired-after-retention, not-yet-archived, missing, unsupported/binary, locator-not-found, integrity-failure, and authorization-denied states without falling back to unsafe rendering.
• Do not execute HTML, SVG, scripts, macros, or active content. Escape text and sandbox any format-specific preview.
• Do not send artifact bodies, exact source contents, or download URLs to Sentry or analytics. Do not add a frontend raw-access activity log.

Acceptance criteria

• A provenance evidence link opens the expected artifact and exact locator when retained.
• The browser supplies only an opaque evidence reference/context; artifact keys and locators are resolved and validated by the backend.
• Supported text formats receive syntax-aware, read-only rendering with safe escaping.
• Large artifacts remain responsive through streaming/range/pagination or virtualization.
• Metadata includes content identity and availability without leaking storage implementation credentials.
• Downloads are authorized through the backend and do not expose permanent or reusable storage URLs.
• Navigation cancels abandoned streams and the UI does not automatically retry size, concurrency, duration, or egress-limit denials.
• Expired, missing, unsupported, corrupt, and locator-not-found artifacts have distinct states.
• Active content cannot execute in the admin origin.
• Error reporting and telemetry omit raw contents and sensitive URLs.
• No edit, replace, or upload control is present.

Out of scope

• Extending the one-year raw retention period.
• Editing, replacing, or uploading artifacts.
• Public artifact access.
• Application-level logging of artifact views/downloads.