How to get a direct file download URL from a public share link in oCIS?

## Describe the bug
I'm new to oCIS. I'm running oCIS 7.1.3 and trying to generate a direct download URL for a file in a project space that a server backend can give to end users — clicking the link should download the file directly without requiring authentication.

I've successfully created a public share link using the Graph API:
```
POST /graph/v1beta1/drives/{driveId}/items/{fileItemId}/createLink
Authorization: Bearer {token}
Content-Type: application/json
```
This returns:
```
{
"link": {
"webUrl": "https://myocis.example.com/s/IoQJOocPMWyAJx"
}
}
{"type":"view"}
```

## What I've tried:

1. Opening https://{domain}/s/{token} in browser → loads web UI with "No resources found" (empty folder view, even though the share is for a single file)

2. https://{domain}/s/{token}/**download** → returns the web UI HTML page (~10KB), not the file

3. WebDAV public-files endpoint:
```
GET /dav/public-files/{token}
```
→ 401 Unauthorized

4. With Public-Token header:

```
GET /dav/public-files/{token}
Headers: Public-Token: {token}
```
→ 401 Unauthorized

## Setup:

- oCIS 7.1.3, Docker Compose, Traefik 2.11 (TLS termination), external Keycloak OIDC
- OCIS_SHARING_PUBLIC_SHARE_MUST_HAVE_PASSWORD: "false"
- The shared file is inside a project space subfolder, item ID format: {storageId}${spaceId}!{itemId}

What is the correct way to get a direct binary download URL for a publicly shared file in oCIS?
Is there a specific endpoint or URL format I'm missing?