AO3-7461 Change send_data to a background job powered workflow

[y7nieSEl5]

Pull Request Checklist

• Have you read "How to write the perfect pull request"?
• Have you read the contributing guidelines?
• Have you added tests for any changed functionality?
• Have you added the Jira issue number as the first thing in your pull request title?
• Do you have fewer than 5 pull requests already open?

Issue

https://otwarchive.atlassian.net/browse/AO3-7461

Purpose

This PR moves large work and CSV download generation out of web requests and into background jobs.

It updates the following download paths:

• Work downloads
• Challenge signup CSVs
• Tag wrangler reports
• Admin bulk-user-search CSVs

When a download is requested, the controller creates a tokenized download record, queues a background job, and redirects to a status page. The job generates the file and uploads it through Active Storage. Once ready, the status page redirects the browser to the storage service URL, allowing S3 to serve the file instead of Puma.

CSV files are written incrementally to a tempfile in the worker while preserving the existing UTF-16LE, tab-separated Excel-compatible format.

Generated files expire after 24 hours. An hourly scheduled cleanup removes expired files and database records.

Testing Instructions

Run the relevant automated tests:

docker compose run --rm test bundle exec rspec \
  spec/models/generated_download_spec.rb \
  spec/controllers/generated_downloads_controller_spec.rb \
  spec/controllers/tag_wranglers_controller_spec.rb \
  spec/controllers/challenge_signups_controller_spec.rb

All tests should pass.
Manually test each download type:
Request a work download in the supported formats.
Request a challenge signup CSV.
Request a tag wrangler report.
Request an admin bulk-user-search CSV.
Confirm each request redirects promptly to a processing page.
Confirm the page automatically initiates the download when the background job completes.
Confirm CSV files open correctly and contain the expected columns and data.
Confirm the completed file is served by the configured Active Storage service rather than through the Rails web response.
Confirm failed generation displays an error page.
Confirm expired downloads return HTTP 410 and are removed by GeneratedDownload.cleanup.

Credit

What name and pronouns should we use to credit you in the Archive of Our Own's Release Notes?

y7nieSEl5, she/her

[y7nieSEl5]

The redirect target is not from request input but generated by the configured Active Storage service from a server-side blob key. Cross-host redirection is intentional so S3 serves the attachment. The generated URL is expiring and uses attachment disposition.

[y7nieSEl5]

the path is built inside a per-download temp directory, the filename is sanitized by Download#clean, and File.basename prevents traversal.

[y7nieSEl5]

The redirect target is not taken from user input. The URL is generated by Active Storage from a server-side blob key blob.service.url(...). The redirect is intentionally cross-host because the file is supposed to be served by S3/storage, not by Puma. The URL is expiring, and the blob metadata comes from a blob we created ourselves in the background job.

The bot probably flagged it because static analyzers treat redirect_to ... allow_other_host: true as suspicious.

The built-in storage redirect route changes HTML downloads to application/octet-stream. That is intentional Rails behavior to avoid serving HTML through a redirect path that could be interpreted inline. In this codebase, that breaks existing file-type expectations for downloaded work files.

Therefore, keeping the Active Storage redirect route would satisfy the security scanner more easily but regress MIME behavior, while keeping the current direct service URL preserves the MIME behavior and is safe in the intended sense, though it will continue to trip the scanner.