Avatar Preview

Public endpoint for avatar images (no auth required).

Downloads from S3 and streams directly with cache headers. Cached at 3 layers: browser (7d) → nginx proxy_cache (7d) → in-memory dict → S3.

Unauthenticated because the URL is rendered in an <img src>, which cannot carry the Bearer header. That makes the reference check below the ONLY thing standing between a stranger and the file: serve a file id ONLY when some row actually points at it as its avatar. Without that check "is it an image?" was the whole gate, so walking the id space returned every chat photo, screenshot and post thumbnail of every workspace — 16398 images against 7 real avatars when this was measured.