Phase 6 red: file download + decryption tests

4 tests: single-chunk download, metadata-title fallback filename,
multi-chunk stream (50-byte chunks to exercise the buffering/split
logic without allocating 4 MiB), and thumbnail download.

Tests encrypt payloads with sodium's secretstream push, serve them
from a mock fetch, and verify the decrypted file on disk.

src/download/index.ts

@@ -0,0 +1,25 @@
+// Stub: see the README "Development workflow" section for TDD policy.
+
+import type { ApiClient } from "../api/client.js";
+import type { EnteFile } from "../model/types.js";
+
+export interface DownloadResult {
+    path: string;
+    bytesWritten: number;
+}
+
+export const downloadFile = async (
+    _api: ApiClient,
+    _file: EnteFile,
+    _outPath?: string,
+): Promise<DownloadResult> => {
+    throw new Error("download.downloadFile not implemented");
+};
+
+export const downloadThumbnail = async (
+    _api: ApiClient,
+    _file: EnteFile,
+    _outPath?: string,
+): Promise<DownloadResult> => {
+    throw new Error("download.downloadThumbnail not implemented");
+};