Display a hosted image from its serving link.

The URL segment after /i/ is parsed as {token}.{ext}; the extension is cosmetic and is never used to derive the Content-Type. The token (everything before the first dot) identifies the image row.

Visibility rules:

• public: served to any caller, including anonymous. A malformed or stale Authorization header does not block a public image; it is treated as an anonymous request.
• private: requires an authenticated caller who owns the image, OR a caller that presents the image's capability secret as the k query parameter (the owner's durable, forwardable view link). Anonymous callers with neither receive 401; authenticated non-owners receive 404.