302 to a fresh Document Service signed URL for one library picture.

Memo content stores this URL (deal_image_content_url) instead of the service's short-lived signed one, so a memo reopened after that signature expired still shows its pictures. The browser reaches it through the portal's /api/backend proxy, which supplies the session's bearer token and nothing else, so the deal is in the path and the controller resolves the caller's account context itself before the deal READ policy; readers with no session (the PDF lambda, the public memo page) never see it — the docgen route swaps it for a signed URL first.