fix: serve downloads only on the site host and select the clicked Quest build

Review follow-ups:
- The downloads routes now answer only on the apex (the site's host) and 404
  on every other accepted host, so the game's open API/CDN subdomains can't
  serve the builds.
- Install on Quest passes its own file to the Quest page instead of always
  picking the newest release.
- Waiting for the bucket's headers is limited to 30 s; the body still streams
  without a limit.
- Dispose the upstream request message; use LINQ in FindFile.

DorkNet.Server/site/src/pages/Downloads.tsx

@@ -73,7 +73,7 @@ function FileCard({ f, rel }: { f: DownloadFile; rel: DownloadRelease }) {
       <div className="mt-auto flex flex-wrap items-center gap-2 pt-1">
         {f.id === 'quest' ? (
           <>
-            <Link className="btn-primary" to="/quest?build=latest">Install on Quest</Link>
+            <Link className="btn-primary" to={`/quest?file=${encodeURIComponent(f.path)}`}>Install on Quest</Link>
             <a className="btn-secondary" href={fileUrl(f)} download={f.name}>Download</a>
           </>
         ) : (