refactor(tts): derive save filename from URL path only

docs/implementation-plan.md

@@ -155,8 +155,8 @@ Low-level fetcher, extracted from the existing scraper.
     (no Steam API call).
   - `fetchModFile(id, apiKey)` / `fetchModFileFromUrl(fileUrl)` — raw save
     bytes + derived filename, with and without the Steam API.
-  - `getFileName(url: string): Promise<string>` — derive filename from the
-    `content-disposition` header.
+  - `getFileName(url: string): string` — derive a filename from the save URL
+    path (the upstream `content-disposition` header is ignored).
 - `errors.ts`
   - Typed errors: missing `file_url`, Steam API failure, rate limit, invalid key.
 - Notes
@@ -237,8 +237,8 @@ Hono server exposing search + fetch.
   - `GET /items/:id` — full parsed `TTSMod`. Accepts an optional `fileUrl`
     query param to download the save directly (no Steam API key needed);
     otherwise resolves via the Steam API.
-  - `GET /items/:id/file` — raw save bytes, filename from `getFileName`. Also
-    accepts `fileUrl`.
+  - `GET /items/:id/file` — raw save bytes, filename from `getFileName` (the
+    URL path). Also accepts `fileUrl`.
 - `routes/asset.ts`
   - `GET /asset?url=...` — fetch an external asset (texture, model) and stream
     it back with a `Content-Type` header. Workshop hosts often omit CORS
@@ -325,7 +325,7 @@ proxy API and `packages/extract` directly for analysis.
 | GET    | `/health`           | Liveness                                     | —    |
 | GET    | `/search?q=&page=`  | Scrape Workshop browse, return item list     | —    |
 | GET    | `/items/:id`        | Full parsed `TTSMod` (`?fileUrl=` skips key) | key* |
-| GET    | `/items/:id/file`   | Raw save bytes, filename from header         | key* |
+| GET    | `/items/:id/file`   | Raw save bytes, filename from URL path       | key* |
 | GET    | `/asset?url=`       | CORS-safe proxy for external assets          | —    |
 | GET    | `/trace?url=&mode=&format=&offset=` | Trace an image into a vector shape (BSON) | —    |