Export states, files, and expiration

Accepted exports move from queued to processing and then completed. A queued job can be canceled. Failures release any remaining reservation according to the credit ledger.

Completed CSV files remain in private object storage. The Download action requests a fresh, short-lived URL after checking account ownership and file expiration.

The worker emits valid UTF-8 CSV and neutralizes spreadsheet-formula injection in text cells. Internal control fields are never offered as export columns.