But the download should just work if it does not bypass Rails as well.
There is a route for it
get "uploads/:site/original/:tree:sha(.:extension)" => "uploads#show", constraints: { site: /\w+/, tree: /([a-z0-9]+\/)+/i, sha: /\h{40}/, extension: /[a-z0-9\._]+/i }
and the show method should just send the file. The nginx config would only make it more efficient by bypassing rails, but this is not a requirement.
Oh.. the authorized_extensions are only for upload authorization, not for downloads (i.e. an extension not being in that list should not prevent a file from being downloaded).
I’m unable to repro this on latest tests-passed so you might want to move it back to Support 
EDIT I googled the site and it seems you have other problems.
Now when I simply wget the file, it works.
(EDIT 2 this could be because you added the mp4 extension to the nginx config? Still, for me it just works out of the box)