Fix hidden library items not rendering in the browser

Items flagged hidden_from_guests (blacklisted tags) returned 404 for
<img> requests since tags cannot send the auth header. The API now
exposes signed raw_url/thumbnail_url fields (mirroring upload previews
and avatars), and the SPA uses them in the gallery, detail view,
duplicates and delete screens, and upload visual matches.

backend/apps/library/services.py

@@ -10,6 +10,7 @@ from pathlib import Path
 
 import imagehash
 from django.conf import settings
+from django.core import signing
 from django.http import FileResponse, Http404, HttpResponse
 from django.utils.text import get_valid_filename
 from PIL import Image
@@ -72,6 +73,18 @@ def index_file(path, folder):
     return item, created_item, location, created_location
 
 
+def signed_media_url(item, user, action="raw"):
+    """Media URL that <img>/<video> tags can load for a signed-in user."""
+    base = f"/api/files/J-{item.id}/{action}/"
+    if user is None or not getattr(user, "is_authenticated", False):
+        return base
+    signature = signing.dumps(
+        {"item": item.id, "user": user.id, "action": action},
+        salt=MEDIA_FILE_SALT,
+    )
+    return f"{base}?sig={signature}"
+
+
 def rename_location_to_j_id(item, location):
     """Name a freshly indexed copy J-<id>.<ext> inside its own folder."""
     path = Path(location.path)