BUG: Pending virus-scan download response is logged as unhandled

**Describe the Bug**

Attempting to download a student file before virus scanning completes correctly returns 403, but the expected security response is emitted as an unhandled exception.

**Expected Behaviour**

The pending-scan response remains blocked and is handled as an expected security state without a misleading unhandled-exception error log.

**Actual Behaviour**

`writeFileToResponse` throws `ForbiddenException`, which `AppAllExceptionsFilter` records as unhandled.

**Related Issue**

#3297 introduced the pending-scan download restriction. This report captures the production logging behavior of that expected restriction.

**Log**

```text
[Nest] 18 - 09/04/2026, 7:24:32 AM LOG [AccessLoggerMiddleware] Request - GET /api/students/student/files/[redacted].pdf From [redacted] | User GUID: [redacted] | User Agent: Safari on iPhone
[Nest] 18 - 09/04/2026, 7:24:32 AM ERROR [AppAllExceptionsFilter] Unhandled exception, request path: /api/students/student/files/[redacted].pdf
{
"stack": "ForbiddenException: This file has not been scanned and will be available to download once it is determined to be safe.\n at StudentControllerService.writeFileToResponse (webpack://studentaid-backend/apps/api/src/route-controllers/student/student.controller.service.ts:161:13)",
"status": 403,
"message": "This file has not been scanned and will be available to download once it is determined to be safe.",
"name": "ForbiddenException"
}
```

Read apps/api/src/route-controllers/student/student.controller.service.ts, especially writeFileToResponse, and then trace how AppAllExceptionsFilter handles the ForbiddenException. Use the pending-scan download scenario from issue #3297 as context. Done means the 403 security response remains blocked and expected without an unhandled-exception error log.

Written by the indexing model from the issue text.