Verify whether Authorization header is needed on file/canvas downloads (browser auth)

[nitrocode]

Context

Follow-up from #141/#142. Noticed while auditing other browser-session request headers.

What's odd

src/slack/files.ts and src/slack/canvas.ts attach a bearer token to plain file/canvas download requests for browser-session auth:

headers.Authorization = `Bearer ${auth.xoxc_token}`;
headers.Cookie = `d=${encodeURIComponent(auth.xoxd_cookie)}`;

A real browser clicking a file link in Slack relies on the session cookie alone; it never attaches a bearer token to a download request. Sending both is a signal a real browser session never produces.

Why this is filed as "needs verification" rather than a ready-to-fix bug

Unlike #141 (UA) or the cookie/header gaps in the other linked issues, this one might be load-bearing: some Slack internal endpoints accept token auth as an alternative to (or in addition to) cookie auth, and file/canvas download URLs may be one of them. Removing the Authorization header without testing could break downloads outright if the cookie alone isn't sufficient for that specific endpoint.

Proposal

Before changing anything: test a file/canvas download with the Authorization header stripped, cookie-only, against a real workspace. If it still succeeds, drop the header to match real browser behavior. If it fails, leave it and close this as "confirmed necessary, not a bug."