xftp: gate web downloads on selected replicas

[pbottine]

Summary

• Add getDownloadServers to return the first-replica servers that the download path actually contacts.
• Switch the XFTP web download host gate to use those selected download servers.
• Update the committed static xftp-web bundle and add regression coverage for first-replica behavior.

Tests

• git diff --check upstream/master..HEAD
• npm install --cache /private/var/folders/xg/y64hd3px7h5_5qbwynrwx5xr0000gn/T/codex-npm-cache --no-package-lock --ignore-scripts
• npm run build
• Attempted: cabal test simplexmq-test --test-option=--match --test-option='gates XFTP web downloads on first-replica servers'
• Blocked locally by the sandbox permission profile denying .pem fixture files during Cabal dependency checkout.

Note: npm install reported two existing critical advisories in the xftp-web dependency tree; this PR does not change dependencies.