feat(core): HTTP Range / partial-content support for operationResource

## Summary

The other half of #52: HTTP Range support (`Accept-Ranges`, `Content-Range`, `206 Partial Content`, `416 Range Not Satisfiable`) for `operationResource`, so file/media downloads can support partial/resumable requests without a hand-written controller.

## Context

#52 originally asked for both SSE and Range support. PR #100 shipped SSE (`op.sse()`) using Nest's native `@Sse()` primitive — low risk, no new plumbing needed. Range is different: Nest has no built-in Range primitive, so this needs genuinely new work:

- Parse the incoming `Range` header.
- Switch the generated method's `@Res()` to non-passthrough (full manual control) so a handler can pipe a stream directly.
- Write `200`/`206` + `Content-Range` + `Accept-Ranges: bytes` + `Content-Length`, or `416` for an invalid/out-of-bounds range.
- Decide the handler contract, something like `(ctx, range) => { stream: Readable; size: number; mimeType: string }`.

None of this has a precedent elsewhere in the codebase, unlike SSE which reused Nest's existing `@Sse()` decorator and streaming response controller.

## Acceptance criteria

- [ ] Documented authoring for at least one Range/partial-response operation.
- [ ] Auth / `public` / `acl` behave like every other operation (checked before any bytes are written, same as `op.sse()`).
- [ ] E2E covers: full response, partial (206) response, invalid range (416), unauthenticated rejection.
- [ ] `CONFIGURATION.md` updated (natural continuation of §6c, which documents `op.sse()` and already notes this as a follow-up).

## References

- Parent: #52 (SSE half shipped in #100)

Start with the operationResource entry point and the existing op.sse() implementation, then read CONFIGURATION.md §6c and the related context in #52 and PR #100. Define the Range handler contract and verify that authorization precedes response output. Done means documented authoring, full and partial responses, invalid-range handling, unauthenticated rejection, and updated E2E coverage.

Written by the indexing model from the issue text.