fix: Doppelter Route-Dekorator auf oo_download entfernt

Der @api_bp.route('/files/onlyoffice-callback') Dekorator war
versehentlich auf oo_download statt onlyoffice_callback gelandet.
Flask routete dadurch alle Callback-POSTs an oo_download, die dann
mit 'missing access_key argument' crashte (500 Error).

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

backend/app/api/office.py

@@ -391,7 +391,6 @@ def onlyoffice_config(file_id):
     return jsonify(config), 200
 
 
-@api_bp.route('/files/onlyoffice-callback', methods=['POST'])
 @api_bp.route('/files/oo-download/<access_key>', methods=['GET'])
 def oo_download(access_key):
     """Dedicated download endpoint for OnlyOffice - no JWT auth, uses one-time key."""