Order Thumbnails

The thumbnails of the first per_order files of each order in code (repeat the parameter, at most 30), for the customer's page when it opens and for an order's dialog.

WHY. Frederick, 2026-10-08, in session with the lead (not issue #4223): "What do we need to do to be able to quickly and easily see people's orders? Because that can't be a big loading time delay either." One request for the whole page, answered from this process's own short-lived copies (memory only, nothing stored); a file with no copy yet is read from its bucket and drawn, all of them together, and waited for order_files.BUDGET_SECONDS. What is not ready is pending (ask again in a second: it is kept being made), what Roost holds no file for is none (the older doors apply), and an order that is not this customer's is refused (the same word whether or not it exists).

SECURITY (reasoning in order_files): the grant is customer_accounts:read; each code must be among the print jobs Pigeonly lists for THIS customer; each file's bucket must be on the allowed set (the same set the picture and letter doors use); the audit row (customer.order_thumbnails_viewed) is written before any thumbnail goes back, and only when one does. Answers: 422 more than 30 codes, a malformed code or a bad per_order; 403 the view could not be recorded; 504 Pigeonly too slow to say whose order it is; and the consumer API's own refusals.