fix(api): generate download filenames from the exported format

[HC-ONLINE]

Description

GET /api/download/{token} always returned Content-Disposition: attachment; filename=export.json, regardless of the real export format (JSON, JSONL, CSV or HTML). The filename was hardcoded in the download route, and the download helper stored file_format="json" for every token, so the metadata needed to build the correct filename was both wrong and inaccessible.

This PR:

• fix: derives the download filename from the token's stored export format, validated against the supported-format allowlist (prevents header injection from registry values). DownloadService.get_info() now exposes token metadata to the route; the helper resolves the real format (service-reported format → export file extension → json fallback) instead of hardcoding "json".
• refactor: centralizes the supported export formats in a single source of truth (ExportFormat Literal + EXPORT_FORMATS in export/base.py, re-exported from ciberwebscan.export), replacing five duplicated inline Literal definitions in the API request models and reusing the set in get_exporter, the download helper and the download route.

Verified end-to-end against a local API instance: exports in all four formats download with the matching filename (export.csv, export.jsonl, export.html, export.json).

Related Issue

None (internal code review finding).

Type of Change

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to not work as expected)
• Documentation update

Checklist

• I have followed the style guidelines of this project (Ruff & Pyright)
• I have performed a self-review of my code
• I have commented my code, particularly in hard-to-understand areas
• I have added tests that prove my fix is effective or that my feature works
• New and existing unit tests pass locally with my changes
• I have updated the documentation accordingly

Screenshots (if applicable)

N/A — API header behavior change; no UI involved.