Changes to Short-lived read-only token the SPA appends to P2 file URLs (photos, documents, signatures). Any signed-in user may call this; it cannot list or write blobs.