Fix iOS download via Content-Disposition header, fix COI gate null check

- Server: presigned GET URLs now include Content-Disposition: attachment header
  when forDownload=true, triggering native browser downloads on all platforms
- Download button uses window.location.href with attachment URL (works on iOS Safari)
- Bulk download uses hidden iframes instead of fetch+blob
- Fix COI gate: getCOIStatus returns null (not undefined) when undeclared,
  so `!== undefined` was always true — changed to `!= null`

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

src/components/shared/file-viewer.tsx

@@ -490,28 +490,21 @@ function BulkDownloadButton({ projectId, fileIds }: { projectId: string; fileIds
     try {
       const result = await refetch()
       if (result.data && Array.isArray(result.data)) {
-        // Download each file via fetch+blob to handle cross-origin URLs
+        // Each URL already has Content-Disposition: attachment from the server,
+        // so we can trigger native downloads by navigating to each URL.
+        // Use hidden iframes to download multiple files without navigating away.
         for (let i = 0; i < result.data.length; i++) {
           const item = result.data[i] as { downloadUrl: string; fileName?: string }
           if (item.downloadUrl) {
-            try {
-              const response = await fetch(item.downloadUrl)
-              const blob = await response.blob()
-              const blobUrl = URL.createObjectURL(blob)
-              const link = document.createElement('a')
-              link.href = blobUrl
-              link.download = item.fileName || `file-${i + 1}`
-              document.body.appendChild(link)
-              link.click()
-              document.body.removeChild(link)
-              URL.revokeObjectURL(blobUrl)
-            } catch {
-              // Fall back to opening in new tab if fetch fails
-              window.open(item.downloadUrl, '_blank')
-            }
-            // Small delay between downloads
+            const iframe = document.createElement('iframe')
+            iframe.style.display = 'none'
+            iframe.src = item.downloadUrl
+            document.body.appendChild(iframe)
+            // Clean up iframe after download starts
+            setTimeout(() => document.body.removeChild(iframe), 10_000)
+            // Small delay between downloads to avoid browser throttling
             if (i < result.data.length - 1) {
-              await new Promise((resolve) => setTimeout(resolve, 500))
+              await new Promise((resolve) => setTimeout(resolve, 800))
             }
           }
         }
@@ -520,7 +513,7 @@ function BulkDownloadButton({ projectId, fileIds }: { projectId: string; fileIds
     } catch {
       toast.error('Failed to download files')
     } finally {
-      setDownloading(false)
+      setTimeout(() => setDownloading(false), 1000)
     }
   }
 
@@ -598,7 +591,7 @@ function FileDownloadButton({ file, className, label }: { file: ProjectFile; cla
   const [downloading, setDownloading] = useState(false)
 
   const { refetch } = trpc.file.getDownloadUrl.useQuery(
-    { bucket: file.bucket, objectKey: file.objectKey },
+    { bucket: file.bucket, objectKey: file.objectKey, forDownload: true, fileName: file.fileName },
     { enabled: false }
   )
 
@@ -607,42 +600,18 @@ function FileDownloadButton({ file, className, label }: { file: ProjectFile; cla
     try {
       const result = await refetch()
       if (result.data?.url) {
-        // Try fetch+blob first (works on desktop, some mobile browsers)
-        try {
-          const response = await fetch(result.data.url)
-          if (!response.ok) throw new Error('fetch failed')
-          const blob = await response.blob()
-          const blobUrl = URL.createObjectURL(blob)
-          const link = document.createElement('a')
-          link.href = blobUrl
-          link.download = file.fileName
-          // iOS Safari needs the link in the DOM
-          link.style.display = 'none'
-          document.body.appendChild(link)
-          link.click()
-          // Delay cleanup for iOS
-          setTimeout(() => {
-            document.body.removeChild(link)
-            URL.revokeObjectURL(blobUrl)
-          }, 100)
-        } catch {
-          // Fallback: open in new tab (iOS Safari often blocks blob downloads)
-          // Open synchronously via a link click to avoid popup blockers
-          const link = document.createElement('a')
-          link.href = result.data.url
-          link.target = '_blank'
-          link.rel = 'noopener noreferrer'
-          link.style.display = 'none'
-          document.body.appendChild(link)
-          link.click()
-          setTimeout(() => document.body.removeChild(link), 100)
-        }
+        // The presigned URL includes Content-Disposition: attachment header,
+        // so the browser will natively download the file (works on iOS Safari too).
+        // Use window.location.href for same-tab navigation which triggers download
+        // without popup blockers interfering.
+        window.location.href = result.data.url
       }
     } catch (error) {
       console.error('Failed to download file:', error)
       toast.error('Failed to download file')
     } finally {
-      setDownloading(false)
+      // Small delay before clearing state so the button doesn't flash
+      setTimeout(() => setDownloading(false), 1000)
     }
   }