DownloadMedia builds its HTTP request directly instead of going through
callAPI, and was missing the Bearer token that the bridge's JWT middleware
requires. As a result, every download_media MCP tool call returned 401.
Fetch a JWT via GetOrRefreshJwtToken (same path the rest of the helpers
use) and set the Authorization header on the request.