fix:use signed R2 URLs for uploaded media

- uploadToR2 now returns storage path instead of a: full URL. - Generate
signed R2 URLs (24h expiration) for images, thumbnails, and videos in
media processor and when loading finds. - Update CSP to allow
*.r2.cloudflarestorage.com for img-src

src/lib/server/r2.ts

@@ -48,7 +48,7 @@ export async function uploadToR2(file: File, path: string, contentType: string):
 		})
 	);
 
-	return `${R2_PUBLIC_URL}/${path}`;
+	return path;
 }
 
 export async function deleteFromR2(path: string): Promise<void> {