admin docs: probe existence with ranged GET (HEAD fails presigned-URL sig)

api/src/routes/admin.ts

@@ -676,8 +676,11 @@ router.get("/api/v1/admin/compliance-orders/:order_number/documents", requireAdm
       try {
         const url = await presignInternal(d.key);
         if (url) {
-          const head = await fetch(url, { method: "HEAD" });
-          present = head.ok;
+          // The presigned URL is signed for GET, so a HEAD request fails the
+          // signature check. Use a 1-byte ranged GET to confirm existence
+          // cheaply without downloading the whole object.
+          const probe = await fetch(url, { headers: { Range: "bytes=0-0" } });
+          present = probe.ok; // 200 or 206
         }
       } catch { /* treat as missing */ }
       return { ...d, exists: present };