Note photo thumbnails were failing because img src pointed at an authenticated endpoint without auth headers. Added AuthImage component that fetches images via Bearer token and renders as blob URLs. Photos now display inline in note entries. Clicking still opens via signed URL.