File redirect route: mint fcs JWT in extension, link from staff report

Path 1 (APIv4 Attachment.get + select url) shipped but didn't fix the
Firebase\JWT decode crash — the deployed Civi version either omits `url`
from Attachment.get or returns it without the fcs param. Falling back to
the bare /civicrm/file?id=X URL hits the same JWT null crash.

Path 2: route file clicks through a tiny redirect endpoint in the Civi
extension instead. The extension runs PHP on Civi, has access to the
crypto.jwt service, and mints the same shape of token Civi's own file
URL builder uses ({exp, "civi.file": <id>}) before 302-redirecting to
the canonical /civicrm/file URL.

Civi extension changes:
- New CRM/WebformMw/Page/File.php — resolves eid from civicrm_entity_file
  if not supplied, signs a 7-day JWT via Civi::service('crypto.jwt'),
  redirects.
- xml/Menu/webform_mw.xml — registers civicrm/webform-mw/file. Requires
  `access CiviCRM` (the user is already authenticated in the parent Civi
  tab when they click the link).

Frontend (StaffReportView.tsx, FieldValue):
- When Attachment.get's url is missing, fall back to the new extension
  route instead of bare /civicrm/file. Attachment.get's url remains the
  fast path when present.

Deploy: admin needs to push the updated extension files to the Civi
server, then Disable/Enable webform-mw (or cv flush) so the new menu
route registers in civicrm_menu.

components/StaffReportView.tsx

@@ -460,16 +460,17 @@ function FieldValue({
     const id = String(v.id);
     const name = v.file_name ?? `file-${id}`;
     // Prefer the Civi-signed URL (carries the fcs JWT) returned by
-    // Attachment.get; Civi's file handler crashes on a null fcs decode if we
-    // hit /civicrm/file?id=X bare. Fall back to a bare URL only if signed
-    // URLs weren't available (e.g. older Civi without `url` on Attachment).
+    // Attachment.get. If absent, fall back to the WebForm-mw Civi extension's
+    // file-redirect route — it mints the fcs server-side and 302s to the
+    // real /civicrm/file URL. (Hitting /civicrm/file?id=X bare crashes Civi
+    // on a null fcs JWT decode.)
     let href = "#";
     if (v.url) {
       href = v.url.startsWith("http")
         ? v.url
         : `${civiBaseUrl}${v.url.startsWith("/") ? "" : "/"}${v.url}`;
     } else if (civiBaseUrl) {
-      href = `${civiBaseUrl}/civicrm/file?reset=1&id=${encodeURIComponent(id)}`;
+      href = `${civiBaseUrl}/civicrm/webform-mw/file?id=${encodeURIComponent(id)}`;
     }
     return (
       <a