Add signed URL helper (URL::SignedRoute equivalent)

[antosubash]

Background

There is no first-class way to mint a temporary signed URL for downloads, unsubscribes, password-reset links, file shares, etc. Modules currently roll their own ad-hoc tokens. Laravel exposes URL::temporarySignedRoute('verification.verify', now()->addMinutes(60), [...]) plus middleware that validates the signature.

Motivation

• Safer, cheaper than DB-backed tokens for one-shot links
• Works without a session / login (perfect for mail links)
• Avoids per-module reinventions and the bugs they bring

Design sketch

Add to SimpleModule.Core:

public interface ISignedUrlGenerator
{
 string Sign(string path, IDictionary<string, string?>? query = null,
 DateTimeOffset? expiresAt = null, string? purpose = null);
 bool TryValidate(HttpRequest request, out SignedUrlClaims claims);
}

public sealed record SignedUrlClaims(string Path, string? Purpose, DateTimeOffset? ExpiresAt);

Implementation:

• HMAC-SHA256 over path?canonicalized-query&expires={unix}&purpose={tag} using IDataProtectionProvider-rooted key (rotates with the data-protection ring)
• Signature appended as ?signature=...&expires=...&purpose=...
• [ValidateSignedUrl] endpoint filter (or extension on RouteHandlerBuilder) verifies and short-circuits 403 on failure
• Optional purpose binds the signature to a specific use case (e.g. purpose=invoice-download) so the same signed URL cannot be replayed against another endpoint

Acceptance criteria

• ISignedUrlGenerator in SimpleModule.Core
• Endpoint filter RequireSignedUrl(purpose?)
• Constant-time signature comparison
• Replay-window enforcement via expires
• xUnit tests: tampering, expiry, wrong purpose, query-order independence
• Docs + sample usage in Email module (unsubscribe link)

References

• Laravel signed URLs: https://laravel.com/docs/urls#signed-urls
• ASP.NET Data Protection: https://learn.microsoft.com/aspnet/core/security/data-protection