Sub-ticket of PLUTO-16 Pluto P1: IDOR on /api/image/[id] — add access-scope check (patient photos fetchable by any authed user) · pluto