▣ wi

Sub-item of #1033 Observability: log /api/image 401/403 auth-denials to appEvents (category auth/authz, level info) so denial-storms are diagnosable; route currently logs only proxy-failures, not the gate denials · pluto