Confirmed on Gitea 1.27.1 (2026-08-12): browser_download_url in the API
response points at an internal hostname (gitea.barky) but the file
downloads correctly once you swap in the instance's public hostname.
Verified end-to-end with a real binary asset (md5sum match) on a private
repo accessed via token.