fix: proxy-image handles internal gallery paths; gallery image endpoint needs no auth

fix: serve gallery images directly from R2 via backend endpoint to fix 403 CORS/presigned URL issues