Returns a 302 redirect to a signed URL for the Certificate of Insurance the payee uploaded for the coverage currently linked to this monitor. Content-Type at that URL matches the file's actual format. Browser pages that cannot follow a cross-site redirect from script should call GET /compliance/insurance-monitors/{monitorId}/certificate-url instead.

PAYER-ONLY, which is what GET /v2/insurance/monitor/{id}/download already enforces. The payee already holds the file they uploaded.

404 covers every case where there is nothing to hand back, and does not distinguish them: the caller is not the payer, the monitor has no linked coverage, the coverage came from a Wingspan-issued plan enrollment rather than an upload, or the import behind it has no file attached.