Sub-ticket of MARS-115 Profile-image IDOR: /api/image/[id] open-proxies profile blobs when no practicaImages row matches; gate on profileImageId ownership (self+admin) else 404 · mars