Downloads the candidate's resume file, streamed directly from storage as a binary response (not JSON), with a Content-Disposition: attachment header whose filename is derived from the stored resume URL. Returns 403 when the caller lacks access or no resume is available for the candidate, and 404 when the resume record has no file URL or the file cannot be located in storage.