Download trigger — Content-Disposition: inline + unknown MIME

Click a button: JavaScript navigates to the file URL. The server responds with an opaque MIME type (application/octet-stream) that the browser cannot render inline, so it downloads the file even under Content-Disposition: inline.

S3 hosting note: the EICAR object is already served as application/octet-stream, so it downloads as-is. A clean PDF is application/pdf (renders inline) — to exercise this case for the clean file, upload a copy with --content-type application/octet-stream (see README) and point CLEAN at it.

ready.

Download trigger — Content-Disposition: inline with unknown MIME