A security pass over how media URLs authenticate. Video and snapshot endpoints take a ?token= query parameter because media elements can't set headers, and that used to accept a full login JWT. It no longer does: media endpoints now reject login JWTs outright and accept only scoped, short-lived media claims minted for exactly that purpose. A leaked media URL is now a leaked thumbnail, not a leaked session.
The web console's snapshot fetches moved onto the same scoped tokens, and a router-walk test now asserts that every protected route rejects unauthenticated requests, so a future endpoint can't silently ship open. Fail closed, always.