paths.funscript should use signed URLs when authentication is enabled

Have you enabled troubleshooting mode?

• I confirm that the troubleshooting mode is enabled.

Describe the bug

When authentication is enabled, Scene.paths.stream and Scene.paths.caption return signed URLs (cid, expires, signature) and do not embed the persistent API key. Scene.paths.funscript still returns a URL with ?apikey= on develop.

For stash-hosted Handy funscripts (useStashHostedFunscript), the UI rewrites /funscript to /interactive_csv and appends the API key. That only works while funscript is unsigned; signing funscript for one path would not be valid on /interactive_csv.

This looks like an inconsistency after #6529 (signed stream/caption) and #3756 (Handy /interactive_csv + apikey).

Steps to reproduce

1. Enable authentication in Stash (Settings → Security) and generate an API key.
2. Use a scene that has a funscript file attached.
3. Run GraphQL (authenticated session):

{ findScene(id: N) { paths { stream funscript caption } } }

1. Compare query parameters on each URL.

Expected behaviour

With authentication enabled:

• paths.funscript uses signed URL parameters and does not include apikey.
• Stash-hosted Handy funscripts should use a signed URL for /interactive_csv (separate from /funscript), so cookieless devices can fetch CSV without the long-lived API key.

Without authentication, current apikey behavior for cookieless access can remain unchanged.

Screenshots or additional context

Example on develop with auth enabled:

• paths.stream → signed, no apikey
• paths.caption → signed, no apikey
• paths.funscript → includes apikey

Related: #6529, #3756, #4850

Stash version

develop

Device details

N/A — GraphQL / API behavior

Relevant log output