Media responses carried Laravel session cookies (Set-Cookie), which made Cloudflare BYPASS the cache for every cover/avatar/banner. These are public files with no user context, so the session/cookie/CSRF chain is unnecessary. Also skips BotDetector (one analytics_bot_logs INSERT per image) and the SEO redirect lookup. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>