# Private images are served only through the access-checked upload API route.
# Never allow direct web access to the raw files.
Require all denied
