[BUG][KYC LINKS] Generate signed document URLs that match the implemented download route

[Obiajulu-gif]

Summary

The signed-link helper returns a dynamic path that has no matching Next.js route, while the actual download handler expects the document reference in a query parameter. Issued links therefore fail before authorization can be evaluated.

Repository evidence

• lib/security/kyc-signed-urls.ts:38-40 emits /api/kyc-documents/{documentId}?token=....
• app/api/kyc-documents/route.ts:20-34 implements /api/kyc-documents?ref=...&token=...; there is no [documentId] route.

Scope

• Choose one canonical download contract and make link generation, route parsing, and API clients agree.
• Add compatibility handling only if already-issued links need a migration window.

Acceptance criteria

• A link returned by /api/kyc-documents/sign successfully reaches the intended document handler.
• The document ID is bound once and cannot disagree between path, query, and token.

Tests

• Round-trip a generated link and add tampered ID/query/path cases.

Non-goals

• Changing token cryptography or access roles.