Sign an on-demand URL

Returns the current status of a render. Poll this endpoint after an async `POST /api/v1/renders` until `status` is `completed` or `failed`. **`status`** transitions: `pending` → `running` → `completed` or `failed`. While not `completed`, `url` is `null`. **`error`** is populated when `status` is `failed`. Truncated to 500 characters. **`webhook_deliveries`** lists every attempt to deliver a webhook for this render, including retries. `source` is `render_webhook` (per-request `webhook_url`) or `global_webhook` (subscription). `null` if no deliveries have been attempted yet. **Download mode** — add `?download=true` to redirect directly to the file. For public renders, redirects to the CDN URL. For secure renders, generates a short-lived (15-minute) presigned S3 URL. Useful for `<a href>` tags or `curl -OL`. When multiple formats were requested, add `?format=pdf`, `?format=png`, etc. to pick which file to download. Defaults to the first file if omitted.