feat(files): streaming ZIP download in the project explorer

Each row of the project Files tab gains a download action, and the toolbar
gains a Download ZIP button scoped to the folder being browsed (at the root,
the whole project). Visible to read-only members too: download is a read.

Single files need no new backend: they reuse GET /api/file?force_download.
Directories go through the new GET /api/file/download, which builds the ZIP
on the fly: an async task walks the tree and async_zip (Astral's maintained
rs-async-zip fork) streams entries into a bounded duplex stream backing the
response body — no temp file, no whole-archive buffer, backpressure for free,
and the task dies with the client. Compression is per entry: Deflate at
maximum level, except files whose magic bytes name an already-compressed
format (media/PDF via the shared sniffer, the ZIP family, gzip/zstd/7z/rar,
compressed audio), which are Stored. Entries are prefixed with the folder
name, empty folders and unix permission bits survive, symlinks are never
followed into the archive, and containment stays fail-closed under the
resolved root. Covered by a round-trip test read back with the crate's own
reader (and verified against unzip/python's zipfile).

web/i18n/it.js

@@ -299,7 +299,9 @@ export default {
   'projects.files.drop':              'Trascina qui i file per caricarli',
   'projects.files.btn.new_folder':    'Nuova cartella',
   'projects.files.btn.upload':        'Carica',
+  'projects.files.btn.download':      'Scarica ZIP',
   'projects.files.uploading':         'Caricamento…',
+  'projects.files.action.download':   'Scarica',
   'projects.files.action.rename':     'Rinomina',
   'projects.files.action.delete':     'Elimina',
   'projects.files.confirm.delete_file': 'Eliminare "{name}"?',