Developer TODO Checklist:

• Role Access verification: This route must be protected. Only logged-in users with a valid `Pastoral` or `Board` membership status are allowed to view or download.
• Setup secure file stream: Serve files via a secure backend route that reads from disk/S3 and pipes output to prevent direct URL hotlinking.
• Audit logging: Log every file read or download with timestamp and user ID.