Implementation plan: Parse AT-URI → get_record → deserialize Document → find wrapped key matching our DID → unwrap_key → get_blob → decrypt_blob → write to disk. All building blocks exist: crypto::unwrap_key, crypto::decrypt_blob, client::get_record, client::get_blob, identity::private_key_bytes. Need AT-URI parsing (simple split) and to wire it all together in download.rs.
Implementation plan: Parse AT-URI → get_record → deserialize Document → find wrapped key matching our DID → unwrap_key → get_blob → decrypt_blob → write to disk. All building blocks exist: crypto::unwrap_key, crypto::decrypt_blob, client::get_record, client::get_blob, identity::private_key_bytes. Need AT-URI parsing (simple split) and to wire it all together in download.rs.