Resolves one viewer asset by its UUID and returns it with a CloudFront
signed policy for accessing the asset's files (same asset_url +
cloudfront signing model as the list endpoint). Used to render assets
that are hidden from the dataset listing — notably chat-scoped figures.
Authorization is dataset RBAC: the asset must belong to the dataset in
the dataset_id claim.