Add in-app experiment file downloads (Downloads menu + ZIP endpoint)

[lamewarden]

Adds a Downloads screen so a researcher can pull their own experiment files straight from the web app — no SSH, no Samba, no leaving the browser. Works from any device on the LAN at http://<pi-ip>:8000, same as the kiosk.

• New GET /api/experiments/{id}/download zips an experiment's whole folder (images, metadata.json, saved config XML) and serves it as an attachment.
• Built to a temp file on disk, not in memory. A multi-day run can accumulate hundreds of JPEGs; holding the archive in an io.BytesIO() would put the whole thing in RAM at once, which risks real memory pressure on a Pi with as little as 2GB — especially one sitting unattended mid-protocol. Disk under storage_root is comparatively abundant. The temp file is removed by a background task once the response is sent.
• New Downloads menu in the top nav (modeled on the existing Import menu for consistency) lists the current researcher's experiments with a per-experiment Download ZIP link.
• The list is filtered client-side by the researcher name already written into each experiment folder. This box has no auth, so that filter is a UI convenience — "my experiments" rather than everyone's — and explicitly not access control. Documented as such in both the code and the README.

Rebased onto main after #12; the only conflict was both branches appending a bullet to the same README feature list. Verified the two features coexist: 158 backend tests pass, npm run typecheck and npm run build clean.