Perf: drop session/bot middleware from /media so Cloudflare can cache images

Media responses carried Laravel session cookies (Set-Cookie), which made
Cloudflare BYPASS the cache for every cover/avatar/banner. These are public
files with no user context, so the session/cookie/CSRF chain is unnecessary.
Also skips BotDetector (one analytics_bot_logs INSERT per image) and the SEO
redirect lookup.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

routes/web.php

@@ -58,9 +58,22 @@ if (! function_exists('animexe_url_is_safe')) {
     }
 }
 
+// Public dosya servisi — kullanıcı bağlamı yok. Session/cookie middleware'i
+// kapalı: yanıta Set-Cookie eklenmeyince Cloudflare bu görselleri edge'de
+// cache'leyebiliyor (cookie'li yanıtı asla cache'lemez). Bot/SEO middleware'i
+// de bir görsel için gereksiz DB işi yapıyordu.
 Route::get('/media/{path}', [MediaController::class, 'show'])
     ->where('path', '.*')
-    ->name('media.show');
+    ->name('media.show')
+    ->withoutMiddleware([
+        \Illuminate\Cookie\Middleware\EncryptCookies::class,
+        \Illuminate\Cookie\Middleware\AddQueuedCookiesToResponse::class,
+        \Illuminate\Session\Middleware\StartSession::class,
+        \Illuminate\View\Middleware\ShareErrorsFromSession::class,
+        \Illuminate\Foundation\Http\Middleware\VerifyCsrfToken::class,
+        \App\Http\Middleware\BotDetector::class,
+        \App\Http\Middleware\SeoRedirectMiddleware::class,
+    ]);
 
 // ── Admin Login ──────────────────────────────────────────────────────────────
 Route::prefix('admin')->name('admin.')->group(function () {