Force lesson materials to download as attachment with readable filename

Direct CDN links opened PDFs inline (no Content-Disposition), which reads
as 'can't download' behind popup blockers / on mobile. New proxy route
streams the file with attachment + human name; lesson link points to it.

src/app/(student)/courses/[slug]/lessons/[lessonId]/page.tsx

@@ -149,9 +149,8 @@ export default async function LessonPage({ params }: Props) {
             {lesson.files.map((file) => (
               <a
                 key={file.id}
-                href={file.url}
-                target="_blank"
-                rel="noopener noreferrer"
+                href={`/api/lesson-files/${file.id}/download`}
+                download={file.name}
                 className="flex items-center gap-3 px-4 py-3 text-sm transition-colors hover:[border-color:var(--foreground)]"
                 style={{ border: "2px solid var(--border)" }}
               >