Proxy recipe image from S3 — avoids TLS issues with presigned URLs on Railway.

Authorization: owner OR recipient of an active RecipeLibraryShare from the owner. RecipeLibraryShare rows are hard-deleted on revoke, so row existence is equivalent to "active share." Any other caller → 404.

Auth transport: same-origin web <img> requests attach the httpOnly beckett_access cookie (path=/api); iOS CachedAsyncImage attaches Bearer. Both resolve via get_current_user → extract_token_from_request.

Cache-Control trade-off: 24h browser cache means a recipient who loses access via share revocation can still see the image from their local cache until it expires. Acceptable vs. the previous bug (any UUID-holder forever) and vs. the round-trip cost of shorter TTLs. Shorten if tighter revocation is needed.