#64 Improve naming consistency and split documents/download.rs

Current state of download.rs has two conceptually distinct paths:

1. Own-PDS (authenticated): fetch_content_key, fetch_document_and_key (private), download_and_decrypt — uses XrpcClient 2. Cross-PDS (grant-based, unauthenticated): download_shared — uses raw Transport

Naming issues:

• fetch_ vs download_ prefix inconsistency (both fetch from PDS)
• download_and_decrypt is verbose, download_shared omits the decrypt part
• 'shared' is vague — the mechanism is a grant

Plan:

• Split into download.rs (own files) and download_grant.rs (cross-PDS grant path)
• Rename download_and_decrypt → download (decryption is always implicit in opake)
• Rename download_shared → download_from_grant (names the mechanism)
• fetch_content_key stays (it's a genuinely different operation — key only, no blob)
• Extract shared decrypt_blob_with_envelope helper to avoid duplicating nonce decode + decrypt