fix: serve downloads only on the site host and select the clicked Quest build

Review follow-ups:
- The downloads routes now answer only on the apex (the site's host) and 404
  on every other accepted host, so the game's open API/CDN subdomains can't
  serve the builds.
- Install on Quest passes its own file to the Quest page instead of always
  picking the newest release.
- Waiting for the bucket's headers is limited to 30 s; the body still streams
  without a limit.
- Dispose the upstream request message; use LINQ in FindFile.

DorkNet.Server/Startup/ServiceCollectionExtensions.cs

@@ -219,8 +219,9 @@ public static class ServiceCollectionExtensions
         services.AddHostedService<TestCaseIssueReconciler>();
         // CI-published client builds for the site's Downloads / Quest pages.
         // Off (IsConfigured=false) without DorkNet:Downloads:BaseUrl. No client
-        // timeout: a multi-GB file streams for longer than the default 100 s;
-        // the request's own abort token still ends it.
+        // timeout: a multi-GB file streams for longer than the default 100 s.
+        // DownloadsService limits the wait for headers itself, and the
+        // request's own abort token ends the stream.
         services.AddHttpClient(DownloadsService.HttpClientName, c => c.Timeout = Timeout.InfiniteTimeSpan);
         services.AddSingleton<DownloadsService>();
         // Scoped (per-request) — these services hold DbContext references and