Change encrypted URL format to /v1/e/{token}/img.{ext}

Add trailing filename to encrypted URLs for better browser compatibility.
The filename is ignored by the server but helps browsers identify content type.

internal/handlers/auth.go

@@ -154,8 +154,14 @@ func (s *Handlers) HandleGenerateURL() http.HandlerFunc {
 			scheme = "http"
 		}
 
+		// Determine file extension for the trailing filename
+		ext := format
+		if ext == "" || ext == "orig" {
+			ext = "jpg" // Default extension
+		}
+
 		host := r.Host
-		generatedURL := scheme + "://" + host + "/v1/e/" + url.PathEscape(token)
+		generatedURL := scheme + "://" + host + "/v1/e/" + url.PathEscape(token) + "/img." + ext
 
 		// Format expiry for display
 		expiresAtStr := "Never"

internal/handlers/imageenc.go

@@ -14,7 +14,8 @@ import (
 	"sneak.berlin/go/pixa/internal/imgcache"
 )
 
-// HandleImageEnc handles requests to /v1/e/{token} for encrypted image URLs.
+// HandleImageEnc handles requests to /v1/e/{token}/* for encrypted image URLs.
+// The trailing path (e.g., /img.jpg) is ignored but helps browsers identify the content type.
 func (s *Handlers) HandleImageEnc() http.HandlerFunc {
 	return func(w http.ResponseWriter, r *http.Request) {
 		ctx := r.Context()

internal/server/routes.go

@@ -56,7 +56,8 @@ func (s *Server) SetupRoutes() {
 	s.router.Head("/v1/image/*", s.h.HandleImage())
 
 	// Encrypted image URL route
-	s.router.Get("/v1/e/{token}", s.h.HandleImageEnc())
+	// The trailing filename (e.g., /img.jpg) is ignored but helps browsers with content type
+	s.router.Get("/v1/e/{token}/*", s.h.HandleImageEnc())
 
 	// Metrics endpoint with auth
 	if s.config.MetricsUsername != "" {