Match real Vuforia's reco counts report URL, expiry and not-ready response

[adamtheturtle]

Closes #3364.

Probes against a real database settled all three open items: a not-ready report is a 404 with the S3 NoSuchKey XML document, storage checks X-Amz-Date plus X-Amz-Expires before the signature, and a second request in the same hour serves the file which the first request generated. The mock now names report files YYYY-mm-dd-HH.csv for the current month and YYYY-mm.csv for the previous month under /reports/{database_id}/, returns a URL with the seven real X-Amz-* query parameters, honors the expiry with the S3 AccessDenied documents, and gives the NoSuchKey document until the report is generated. The download tests now also run against real Vuforia, with new coverage of the URL shape, file names, same-hour collisions, expiry and the missing query, and mock-only tests create their own database via a new add_cloud_database helper because the shared fixture database reuses one ID across a run. The differences doc describes the real URL shape and the deliberate signature difference, and the unverified-behavior entry for the not-ready response is removed.

🤖 Generated with Claude Code