Fix hidden library items not rendering in the browser

Items flagged hidden_from_guests (blacklisted tags) returned 404 for
<img> requests since tags cannot send the auth header. The API now
exposes signed raw_url/thumbnail_url fields (mirroring upload previews
and avatars), and the SPA uses them in the gallery, detail view,
duplicates and delete screens, and upload visual matches.

frontend/src/components/MediaCard.tsx

@@ -18,9 +18,7 @@ const ratingLabels: Record<string, string> = {
 
 export function MediaCard({ item }: { item: MediaItem }) {
   const preview =
-    item.kind === "video"
-      ? `/api/files/${item.j_id}/thumbnail/`
-      : `/api/files/${item.j_id}/raw/`;
+    item.kind === "video" ? item.thumbnail_url : item.raw_url;
   const rating = item.display_rating;
 
   return (