Endpoint for downloading every file attached to a candidate's application as a single zip archive. This endpoint returns the files a candidate uploaded during the application process, such as resumes, certifications and licences, bundled into one archive served as an attachment. If the candidate exists but has no files attached, the request still succeeds with a 200, and the body is a short JSON message instead of an archive. Callers should therefore check the response Content-Type before treating the body as binary. Access is authorised per candidate: the caller must have permission on the job the candidate applied to, otherwise the request is rejected with a 403.