Fix hidden library items not rendering in the browser

Items flagged hidden_from_guests (blacklisted tags) returned 404 for
<img> requests since tags cannot send the auth header. The API now
exposes signed raw_url/thumbnail_url fields (mirroring upload previews
and avatars), and the SPA uses them in the gallery, detail view,
duplicates and delete screens, and upload visual matches.

frontend/src/features/library/DeletePage.tsx

@@ -229,7 +229,7 @@ export default function DeletePage() {
                   >
                     <div className="relative aspect-square overflow-hidden bg-ctp-mantle">
                       <img
-                        src={`/api/files/${item.j_id}/thumbnail/`}
+                        src={item.thumbnail_url}
                         alt={item.filename}
                         loading="lazy"
                         className="h-full w-full object-cover"