fix: add query param token auth for file serving (iframe compat)

iframe/img tags can't send Bearer headers. File endpoint now accepts
?token= query parameter for authentication. Frontend passes access
token in URL for PDF/image viewers.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

frontend/src/routes/documents/[id]/+page.svelte

@@ -1,7 +1,7 @@
 <script>
   import { onMount } from 'svelte';
   import { page } from '$app/stores';
-  import { api } from '$lib/api';
+  import { api, getAccessToken } from '$lib/api';
   import { addToast } from '$lib/stores/ui';
   import { marked } from 'marked';
 
@@ -56,12 +56,12 @@
           </div>
         {:else if viewerType === 'pdf'}
           <iframe
-            src="/api/documents/{doc.id}/file"
+            src="/api/documents/{doc.id}/file?token={getAccessToken()}"
             class="w-full h-[80vh] rounded"
             title={doc.title}
           ></iframe>
         {:else if viewerType === 'image'}
-          <img src="/api/documents/{doc.id}/file" alt={doc.title} class="max-w-full rounded" />
+          <img src="/api/documents/{doc.id}/file?token={getAccessToken()}" alt={doc.title} class="max-w-full rounded" />
         {:else if viewerType === 'synology'}
           <div class="text-center py-10">
             <p class="text-[var(--text-dim)] mb-4">Synology Office 문서</p>