Follows the key's move out of the component module, so the explorer state and
the preview test both address it through the same factory.
Also return the signed URL through `HttpResponse.json` with its response type,
which is what the mock-API convention asks of a success response.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01N3euXsz25sTybsGTcxCFfn