Fix hidden library items not rendering in the browser

Items flagged hidden_from_guests (blacklisted tags) returned 404 for
<img> requests since tags cannot send the auth header. The API now
exposes signed raw_url/thumbnail_url fields (mirroring upload previews
and avatars), and the SPA uses them in the gallery, detail view,
duplicates and delete screens, and upload visual matches.

backend/apps/library/serializers.py

@@ -5,7 +5,12 @@ from django.core import signing
 from rest_framework import serializers
 
 from .models import MediaItem, MediaLocation, TempUpload, DownloadTask
-from .services import MEDIA_FILE_SALT, UPLOAD_FILE_SALT, VIDEO_EXTENSIONS
+from .services import (
+    MEDIA_FILE_SALT,
+    UPLOAD_FILE_SALT,
+    VIDEO_EXTENSIONS,
+    signed_media_url,
+)
 
 
 class MediaLocationSerializer(serializers.ModelSerializer):
@@ -22,6 +27,8 @@ class MediaItemSerializer(serializers.ModelSerializer):
     locations = MediaLocationSerializer(many=True, read_only=True)
     j_id = serializers.SerializerMethodField()
     display_rating = serializers.SerializerMethodField()
+    raw_url = serializers.SerializerMethodField()
+    thumbnail_url = serializers.SerializerMethodField()
     filename = serializers.SerializerMethodField()
     extension = serializers.SerializerMethodField()
     kind = serializers.SerializerMethodField()
@@ -42,6 +49,8 @@ class MediaItemSerializer(serializers.ModelSerializer):
             "filename",
             "extension",
             "kind",
+            "raw_url",
+            "thumbnail_url",
             "uploaded_by",
             "uploaded_by_id",
             "e621_post_id",
@@ -59,6 +68,8 @@ class MediaItemSerializer(serializers.ModelSerializer):
             "filename",
             "extension",
             "kind",
+            "raw_url",
+            "thumbnail_url",
             "uploaded_by",
             "uploaded_by_id",
             "e621_post_id",
@@ -68,9 +79,22 @@ class MediaItemSerializer(serializers.ModelSerializer):
             "updated_at",
         ]
 
+    def _request_user(self):
+        request = self.context.get("request")
+        user = getattr(request, "user", None)
+        if user is None or not getattr(user, "is_authenticated", False):
+            return None
+        return user
+
     def get_j_id(self, obj):
         return f"J-{obj.id}"
 
+    def get_raw_url(self, obj):
+        return signed_media_url(obj, self._request_user(), "raw")
+
+    def get_thumbnail_url(self, obj):
+        return signed_media_url(obj, self._request_user(), "thumbnail")
+
     def get_display_rating(self, obj):
         if obj.rating:
             return obj.rating