The runtime kept reading aksrt_download_config after the settings page was
removed, so the frontend still issued download links per the stale option
values instead of the built-in defaults.
- Pin endpoint, per-token uses and TTL to built-in constants and drop all
option reads plus the is_enabled() master switch
- Remove the now-unreachable direct-download branches from the download
box template and the paid-card download helper
- Lock the pinned contract in the download contract tests